NetApp onboarding - audit folder/files deletion

[corti77]

Hi,

I wonder the easiest way to monitor the deletion of files/folders in a CIFS netapp using splunk.

I saw an Add-on available, could someone share any experience with this use case?

I have a SC4S in place so I thought to configure syslog in NetApp to be sent to SC4S and start digging into the logs. Is there any App I could leverage to ease the pain?

many thanks

[noahlam1]

@corti77 Just curious, have you set up the API calls to Netapp using the Splunk_TA_ontap and SA-Hydra app? We are setting it up currently and have been running into an issue we can't resolve and can not find much help online.

[corti77]

Thanks for your reply @gcusello , my question was more on how to build the solution. 

I found some information about configuring netapp

https://storageexorcist.wordpress.com/2020/06/03/ontap-native-nas-auditing-smb-and-nfs/

So maybe it is a matter of configuring it like that and sending those logs via syslog to splunk?

[gcusello]

Hi @corti77 ,

you have to configure your netapp to send syslogs using a protocolo (TCP or UDP) on a port.

At the same time, on rsyslog (or syslog-ng) you have configure receiving followinf the instructions at https://www.rsyslog.com/doc/index.html and writing logs in a file with a path (usually containing hostname) and a filename.

then in the Forwarder, you have to add the add-one for Netapp ( https://splunkbase.splunk.com/app/3418 ) to the Forwarder adding an inputs.conf in local folder.

In this inputs.conf, use the batch command that reads and deletes logs instead of monitor, the instructions about how to take logs, see at https://docs.splunk.com/Documentation/Splunk/9.3.2/Data/Usingforwardingagents

Ciao.

Giuseppe

[gcusello]

Hi @corti77 ,

I don't use SC4S but usually rsyslog and a Universal Forwarder that's the same thing.

So I usually (except when there are very big files to read)use the batch command, instead of monitor command in the inputs.conf.

Ciao.

Giuseppe