By default all that is enabled is LOGON and LOGOFF events,  which does not track the share name or anything like that... You have a whole slew of options,  but (and I can't stress this enough) USE CAUTION.  Excess logging can and will cause performance issues with the entire cluster.  That being said,  here are some examples:  To log share a which share a user accesses:  isi smb config global modify --audit-fileshare=success  To log file deleted: isi smb config global modify --audit-global-sacl-success=std_delete To log file opens: isi smb config global modify --audit-global-sacl-success=generic_exec To log creation, edits, and renames: isi smb config global modify --audit-global-sacl-success=generic_write To log opens, deleted, creates, edits, renames: isi smb config global modify --audit-global-sacl-success=generic_all  Also the logs will fill up very, very, very quickly if you have a lot of activity...  There are a bunch more,  but that is the basic idea...    again BE CAREFUL.... don't kill your cluster... when in doubt,  engage support.
Hello,   we have a requirement to record the users who use each share for past 30 days. is there any way we can trap that info ? its like xxx:/ifs/share1  is used by 5 users we need their AD account info. i hope someone out there have a this requirement for audit purpose [IMAGE]  thanks, Raj
ISILON Users Audit