--- title: "Auditing SMB File Access" slug: "auditing-smb-file-access-5-1-1-1-1" tags: ["Edge Filer", "Gateway", "Filer", "7.13"] updated: 2026-09-17T11:44:04Z published: 2026-09-17T11:44:04Z canonical: "kb.ctera.com/auditing-smb-file-access-5-1-1-1-1" --- > ## Documentation Index > Fetch the complete documentation index at: https://kb.ctera.com/llms.txt > Use this file to discover all available pages before exploring further. # Auditing SMB File Access The CTERA Edge Filer provides audit logs of the SMB file access operations performed on the CTERA Edge Filer. This enables organizations to ensure compliance with internal policies and regulations. **Note** The SMB audit log does not record sync operations between the CTERA Edge Filer and a CTERA Portal. **To enable SMB audit logs:** 1. Create the share where the audit log entries will be saved, as described in [Managing Network Shares](/v1/docs/managing-network-shares-5-1-1-1-1). 2. In the **Configuration** view, select **Logs > Audit Logs** in the navigation pane. The **Audit Logs** page is displayed. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-UPY0YBD2.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A34%3A28Z&se=2026-11-11T05%3A34%3A28Z&sr=c&sp=r&sig=mlnjT3XXknM1uW6zwRU7raUesrwhtBpgIgoIKsrtz1A%3D) 3. Slide **Enable CIFS/SMB Audit Logs** on. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-N53ATSUL.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A34%3A28Z&se=2026-11-11T05%3A34%3A28Z&sr=c&sp=r&sig=mlnjT3XXknM1uW6zwRU7raUesrwhtBpgIgoIKsrtz1A%3D) 4. Click the **Save Log Files To (Required)** field. The following window is displayed, listing the available shares. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-PKDLVXAO.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A34%3A28Z&se=2026-11-11T05%3A34%3A28Z&sr=c&sp=r&sig=mlnjT3XXknM1uW6zwRU7raUesrwhtBpgIgoIKsrtz1A%3D) 5. Select the share to save the log files and click **Select**. The audit logs are saved to **/*share*/audit.log.dir**. 6. Optionally, change the following logging details as desired: **Rotate Files Every** (time limit) – How often to rollover the log files. You can define the rotation time in minutes, hours or days. **Rotate Files Every** (size limit) – When to rollover the log files if they grow large. You can define the rotate size in KB, MB, or GB. **Units** – The unit to define the rotate size in KB, MB, or GB. **Keep Closed Log Files For** – The number of days to keep closed log files. A background task is run every 10 minutes and checks these values. For example, if the time to rotate the file has passed or if the size is over the specified size the log file is rotated. Note that this can mean that the file can be larger than the specified value as it will grow until the 10-minute check is performed. The task also checks if closed log files have exceeded the specified time and any closed log file that has exceeded this time is deleted. **Note** If closed log files have exceeded the time specified in **Keep Closed Log Files For** and are deleted, and these deleted log files were not sent to the portal. For example, when the connection to the portal is down for a long time, the information in these deleted log files is lost. This should never normally happen if the default for **Keep Closed Log Files For** is not set to too short a time. 7. In the **Events to Log** area, optionally change the events to log, based on your organization's needs. To add or delete events to log, scroll through the list and slide on or off the appropriate options. 8. Optionally, for the **Set ACL** event, slide **Log permission changes in human readable format** on, for changes in ACL permissions to files and folders to be reported in the audit log in an understandable format. Where: ace-type indicates the type of ACE (allow/deny) ace-rights indicates the type of permissions/AccessMask ace-flags indicates the ACE behavior **Note** Setting the log to be readable degrades performance. CTERA recommends **not** setting this option, unless you really need it. 9. If you made any changes, either click **Save** or click **Revert** to revert to the last saved configuration. CTERA Edge Filer generates audit log messages upon various operations. ## Example Log Entries ### open ``` July 30 08:33:42 2022EdgeFiler smbd: |2022EdgeFiler|ctera_audit|fs|ok|0x00000000|user=2022EDGEFILER\admin|sid=S-1-5-21-2761415951-3033486807-2004858877-1402|op=open|timestamp=1609310022|local_time=1609302822|rootPath=/var/vol/syncgateway/cloudshare|share=cloud|path=users/portal admin/My Files/Photos/CopiedFile - Copy.png|access=01101001100000000100100000000000|remote hostname=10.212.134.55|| ``` ### read ``` July 30 08:33:41 2022EdgeFiler smbd: |2022EdgeFiler|ctera_audit|fs|ok|0x00000000|user=2022EDGEFILER\admin|sid=S-1-5-21-2761415951-3033486807-2004858877-1402|op=read|timestamp=1609310021|local_time=1609302821|rootPath=/var/vol/syncgateway/cloudshare|share=cloud|path=users/portal admin/My Files/Photos/CopiedFile - Copy.png|type=file|remote hostname=10.212.134.55|fileSize=148071|dataRW=4096|| ``` ### write ``` July 30 08:33:51 2022EdgeFiler smbd: |2022EdgeFiler|ctera_audit|fs|ok|0x00000000|user=2022EDGEFILER\admin|sid=S-1-5-21-2761415951-3033486807-2004858877-1402|op=write|timestamp=1609310031|local_time=1609302831|rootPath=/var/vol/syncgateway/cloudshare|share=cloud|path=users/portal admin/My Files/Photos/~$w Microsoft Word Document1.docx|type=file|remote hostname=10.212.134.55|fileSize=54|dataRW=113|| ``` ### move ``` July 30 08:34:06 2022EdgeFiler smbd: |2022EdgeFiler|ctera_audit|fs|ok|0x00000000|user=2022EDGEFILER\admin|sid=S-1-5-21-2761415951-3033486807-2004858877-1402|op=move|timestamp=1609310046|local_time=1609302846|rootPath=/var/vol/syncgateway/cloudshare|share=cloud|source path=users/portal admin/My Files/Photos/New Microsoft Word Document1.docx|destination path=users/portal admin/My Files/Photos/E0EAEC4D.tmp|type=file|remote hostname=10.212.134.55|| ``` ### create ``` July 30 08:33:51 2022EdgeFiler smbd: |2022EdgeFiler|ctera_audit|fs|ok|0x00000000|user=2022EDGEFILER\admin|sid=S-1-5-21-2761415951-3033486807-2004858877-1402|op=create|timestamp=1609310031|local_time=1609302831|rootPath=/var/vol/syncgateway/cloudshare|share=cloud|path=users/portal admin/My Files/Photos/~$w Microsoft Word Document1.docx|type=file|remote hostname=10.212.134.55|| ``` ### delete **fail operation** ``` July 30 08:33:42 2022EdgeFiler smbd: |2022EdgeFiler|ctera_audit|fs|fail|0xc0000034|user=2022EDGEFILER\admin|sid=S-1-5-21-2761415951-3033486807-2004858877-1402|op=delete|timestamp=1609310022|local_time=1609302822|rootPath=/var/vol/syncgateway/cloudshare|share=cloud|path=users/portal admin/My Files/Photos/._CopiedFile - Copy.png|type=file|remote hostname=10.212.134.55|fileSize=10000|dataRW=18446744073709551615|| ``` **ok operation** ``` July 30 08:33:42 2022EdgeFiler smbd: |2022EdgeFiler|ctera_audit|fs|ok|0x00000000|user=2022EDGEFILER\admin|sid=S-1-5-21-2761415951-3033486807-2004858877-1402|op=delete|timestamp=1609310022|local_time=1609302822|rootPath=/var/vol/syncgateway/cloudshare|share=cloud|path=users/portal admin/My Files/Photos/CopiedFile - Copy.png|type=file|remote hostname=10.212.134.55|fileSize=10000|dataRW=18446744073709551615|| ``` ### setattrib ``` July 30 08:33:42 2022EdgeFiler smbd: |2022EdgeFiler|ctera_audit|fs|ok|0x00000000|user=2022EDGEFILER\admin|sid=S-1-5-21-2761415951-3033486807-2004858877-1402|op=setattrib|timestamp=1609310022|local_time=1609302822|rootPath=/var/vol/syncgateway/cloudshare|share=cloud|path=users/portal admin/My Files/Photos/CopiedFile - Copy.png|dosattrib=0000|remote hostname=10.212.134.55|| ``` ### getea ``` July 29 10:30:47 2022EdgeFiler smbd: |2022EdgeFiler|ctera_audit|fs|fail|0xc0000225|user=2022EDGEFILER\admin|sid=S-1-5-21-2761415951-3033486807-2004858877-1402|op=getea|timestamp=1609230647|local_time=1609223447|rootPath=/var/vol/syncgateway/cloudshare|share=cloud|path=/var/vol/syncgateway/cloudshare|att=org.netatalk.Metadata|remote hostname=10.212.134.70|| ``` Each field in the message is separated by the | character. The fields in the examples have the following meaning: **Timestamp and edge filer name** – Each line in the audit log starts with the timestamp when it was written to the log and the edge filer connected to. For example, `July 30 08:33:42 2022EdgeFiler smbd: ` **Edge filer name** – The name of the device on which the operation was executed. For example, `2022EdgeFiler` **Log name** – The name of the audit log: `ctera_audit` **Type** – The audit type. **Operation result** – The result, either **ok** or **fail**. **Operation result code** – The result code for the operation. `0xc0000000` for ok. fail is `0xc0000225` **User name** – The name of the user who executed the operation. For example, `user=2022EDGEFILER\admin` **User SID** – The security identifier. For example, `sid=S-1-5-21-2278938113-1352723297-1199027263-1402` **Operation** – The operation that was executed. For example, `op=open` **Timestamp** – The UTC time the operation was executed. For example, `timestamp=1609230647` **Local time** – The local time the operation was executed. For example, `local_time=1609223447` **Root Path** – The root path for the share. For example, `rootPath=/var/vol/syncgateway/cloudshare|share=cloud` **Share** – The name of the share. For example, `share=cloud` **Path** – The path to a file being handled. For example, `path=users/portal admin/My Files/Photos/New Microsoft Word Document1.docx` **Destination** – The destination for a move or copy operation. For example, `destination path=users/portal admin/My Files/Photos/E0EAEC4D.tmp` **Type** – Whether the operation is on a folder or file. **Attributes** – The attributes, either in readable format, for example, `att=org.netatalk.Metadata` or machine readable, for example, `dosattrib=0000dosattrib=0000` **Access code** – The access code. For example, `access=00000100000000000000000000000000` **Remote hostname** – The IP address of the device connected using SMB to the edge filer. For example, `remote hostname=10.212.134.70` **File size** – The size of the file being operated on. For example, `Size=18446744073709551615` **Data Read/Write** – For example, `dataRW=18446744073709551615` **Directory** – Whether the operation is on a directory or not. For example, `isDir=1` The operations have the following meanings: | Operation in Log | Description | | --- | --- | | **read** | Open a file for reading | | **create, write, move** | Create or write to a file | | **create** | Create a folder | | **getea** | Get the extended attributes | | **setea** | Set the extended attributes | | **delea** | Delete an extended attribute | | **open** | Open a file | | **delete, move** | Delete a file or folder | | **getattrib** | Get the attributes | | **setattrib** | Set the attributes | | **ACEChanged** | Change permissions | | **ACLAdded, ACLDeleted, ACLProtectionAdded, ACLProtectionDeleted** | Change access permissions | | **setdacl** | Set permissions | | **getsd** | The security descriptor of a file or directory is fetched | | **setsd, AclDenied** | The security descriptor of a file or directory is set | | **chown, AclDenied** | Change the owner |