Skip to main content

Determine what the complete path to the audited object is

Contributors netapp-aherbin
PDFs

The object path printed in the <ObjectName> tag for an audit record contains the name of the volume (in parentheses) and the relative path from the root of the containing volume. If you want to determine the complete path of the audited object, including the junction path, there are certain steps you must take.

Steps

  1. Determine what the volume name and relative path to audited object is by looking at the <ObjectName> tag in the audit event.

    In this example, the volume name is “data1” and the relative path to the file is /dir1/file.txt:

    <Data Name="ObjectName"> (data1);/dir1/file.txt </Data>

  2. Using the volume name determined in the previous step, determine what the junction path is for the volume containing the audited object:

    In this example, the volume name is “data1” and the junction path for the volume containing the audited object is /data/data1:

    volume show -junction -volume data1

                                    Junction                    Junction
Vserver   Volume       Language Active    Junction Path     Path Source
--------- ------------ -------- --------  ----------------- -----------
vs1       data1        en_US.UTF-8
                                true      /data/data1       RW_volume

  3. Determine the full path to the audited object by appending the relative path found in the <ObjectName> tag to the junction path for the volume.

    In this example, the junction path for the volume:

    /data/data1/dir1/file.text