Configure CTERA Edge Filers for auditing

Prerequisites

Note: If you have already connected a CTERA Edge Filer to AD, skip this section and proceed to Configure CTERA Edge Filers.

To define users from an AD domain

1. On the CTERA Portal, navigate to Configuration > Shares > Windows File Sharing.
2. Click Connect to Domain/Workgroup.



3. Connect a CTERA Edge Filer to your AD domain:
   • In the Connect to Domain/Workgroup window, click Domain, enter your domain name, and click Next.
   • In the Join an Active Directory Domain window, enter the domain administrator's username and password.
   • Click Next > Finish.

Refer to CTERA's Adding and Editing Users document for more information.

Configure CTERA Edge Filers

To enable SMB audit logs

1. On the CTERA Portal, navigate to Configuration > Logs > Audit Logs.
2. In the Audit Logs window, select the Enable CIFS/SMB Audit Logs option.



3. In the Save log files to field:
   • If you have created network shares, a window will display the available network shares. Select the network share where you want to save the log files.

   Click Close if you want to create a different network share for the log files, then create the network share as described in Managing Network Shares.

   • If you have not created network shares, a pop-up will display, "No network shares available." Click Want to create one now. A window will display the volumes and folders on the CTERA Edge Filer. Follow the steps to define the network share as described in Managing Network Shares. The network share is selected as the destination to save the log files.
   • If you do not want to create a network share for the audit logs, click Close.

   

   The audit log will be saved to /network_share/audit.log.dir/audit.log.

4. Optionally, change the following logging details as desired:
   • Rotate files every: Choose how often to roll over the log files. You can define the rotation time in minutes, hours, or days.
   • Rotate files every: Choose when to roll over the log files if they grow large. You can define the rotation size in KB, MB, or GB.
   • Keep closed log files for: Choose the number of days to keep closed log files.

   A background task runs every 10 minutes and checks these values. For example, if the time to rotate the file has passed or if the size exceeds the specified limit, the log file is rotated. Note that the file can grow larger than the specified size before the 10-minute check is performed.

   The task also checks for and deletes any closed log files that have exceeded the specified retention time.

5. Check the following eight events under Events to Log:

Event	Description
List Folder Read Data	Log when data is read from a file.
Create Files Write Data	Log when data is written or appended to a file.
Create Folders Append Data	Log when a directory is created.
Traverse Folder Execute File	Log an attempt to open a file.
Delete Subfolders and Files	Log when subfolders and files are deleted.
Delete	Log when a file or directory is deleted.
Change Permissions	Log any change to file or directory access permissions.
Change Owner	Log when the owner of a file or directory is modified.

6. Check Log permission changes in human readable format to ensure that changes in ACL permissions for files and folders are reported in an understandable format in the audit logs. The details include:
• ace-type: Indicates the type of access control entry (ACE): allow or deny
• ace-rights: Indicates the type of permissions or access masks
• ace-flags: Indicates the ACE behavior
7. Click Save. The CTERA Edge Filer will now generate audit log messages on various operations.