Skip to main content

Managing audit logging for management activities

ONTAP audit logging creates a record of activities that take place on the management interface. The audit logs can be used for monitoring, analysis, and backup purposes.

  • Changes to audit logging in ONTAP 9
    Beginning in ONTAP 9, the command-history.log file is replaced by audit.log, and the mgwd.log file no longer contains audit information.
  • How ONTAP implements audit logging
    Management activities recorded in the audit log are included in standard AutoSupport reports, and certain logging activities are included in EMS messages. You can also forward the audit log to destinations that you specify, and you can display audit log files by using the CLI or a web browser.
  • Forwarding the audit log to a destination
    You can forward the audit log to a maximum of 10 destinations that you specify by using the cluster log-forwarding create command. For example, you can forward the log to a Splunk or syslog server for monitoring, analysis, or backup purposes.
  • Commands for managing audit settings for management activities
    You use the security audit commands to manage which management activities are logged in the audit.log file. You use the cluster log-forwarding commands to manage destinations for forwarding the audit log to.