Manually rotate the audit event logs
Before you can view the audit event logs, the logs must be converted to user-readable formats. If you want to view the event logs for a specific storage virtual machine (SVM) before ONTAP automatically rotates the log, you can manually rotate the audit event logs on an SVM.
Rotate the audit event logs by using the
vserver audit rotate-logcommand.
vserver audit rotate-log -vserver vs1
The audit event log is saved in the SVM audit event log directory with the format specified by the auditing configuration (
EVTX), and can be viewed by using the appropriate application.