yes, there will be an entry and it will reference the original file location  isilonpoc-2: [409: Wed Dec 27 14:58:10 2017] {"id":"43cafdb5-eb40-11e7-a246-0050568f78d1","timestamp":1514404690590053,"payloadType":"c411a642-c139-4c7a-be58-93680bc20b41","payload":{"protocol":"SMB2","zoneID":1,"zoneName":"System","eventType":"create","createResult":"OPENED","isDirectory":false,"desiredAccess":128, "clientIPAddr":"10.110.13.36","createDispo":1,"userSID":"S-1-5-21-4279633407-28481931-2677731258-308429","userID":1000000,"fileName":"\\ifs\\clustername\\cifs\\bob\\Home\\scripts\\ok","ntStatus":0,"fsId":1,"partialPath":"\\scripts\\ok","rootInode":4309909598,"inode":4312050860}}
Does anybody know whether or not Isilon audit log function captures snapshot access through Windows Previous Version tab? For example, if a user opens a file from Previous Version tab in Windows Folder Properties and accesses to Isilon's snapshot, does Isilon audit log records the action in its log?  Thank you,
Does audit log record snapshot access through previous version tab (Windows)?