Manage file access logs in Azure NetApp Files (preview)

File access logs provide file access logging for individual volumes, capturing file system operations on selected volumes. The logs capture standard file operation. File access logs provide insights beyond the platform logging captured in the Azure Activity Log.

Considerations

• Once file access logs are enabled on a volume, they can take up to 75 minutes to become visible.
• Each log entry consumes approximately 1 KB of space.
• File access logs occasionally create duplicate log entries that must be filtered manually.
• Deleting any diagnostic settings configured for ANFFileAccess causes any file access logs for any volume with that setting to become disabled. See the diagnostic setting configuration for more information.
• Before enabling file access logs on a volume, either access control lists (ACLs) or Audit access control entries (ACEs) need to be set on a file or directory. You must set ACLs or Audit ACEs after mounting a volume.
• Azure NetApp Files file access logs provide detailed information about successful and failed requests to the storage service. This information can be used to monitor individual requests and to diagnose file access issues. Requests are logged on a best-effort basis, meaning that most requests result in a log record, but the completeness and timeliness of file access logs aren't guaranteed. The Azure NetApp Files file access logs feature doesn't provide explicit or implicit expectations or guarantees around logging for auditing and compliance purposes.

Performance considerations

• All file access log file access events have a performance impact.

  • Events such as file/folder creation or deletion are key events to log.
  • System access control list (SACL) settings for logging should be used sparingly. Frequent operations (for example, READ or GET) can have significant performance impact, but have limited logging value. It's recommended that SACL setting not log these frequent operations to conserve performance.
  • SACL policy additions aren't currently supported with file access logs.

• When clubbing events such as READ/WRITE, only a handful of operation per file read or write are captured to reduce event logging rate. 

• File access logs support a log generation rate metric. The log generation rate shouldn't exceed 64 MiB/minute.

  If the rate of file access event generation exceeds 64 MiB/minute, the Activity log sends a message stating that the rate of file access log generation is exceeding the limit. If log generation exceeds the limit, logging events can be delayed or dropped. If you're approaching this limit, disable noncritical auditing ACLs to reduce the event generation rate. As a precaution, you can create an alert for this event.

• During migration or robocopy operations, disable file access logs to reduce log generation.

• It's recommended you avoid enabling file access logs on files with more than 450 ACEs to avoid performance issues.

Recognized events

The events capture in file access logs depend on the protocol of your volume.

Logged NFS events

• Close
• Create
• Get attributes
• Link
• Nverify
• Open
• Open attribute
• Remove
• Rename
• Set attribute
• Verify
• Write

Logged SMB events

• Create
• Delete
• Get attributes
• Hard link
• Open object
• Open object with the intent to delete
• Read
• Rename
• Set attribute
• Unlink
• Write

Register the feature

The file access logs feature is currently in preview. If you're using this feature for the first time, you need to register the feature first.

1. Register the feature:

     Register-AzProviderFeature -ProviderNamespace Microsoft.NetApp -FeatureName ANFFileAccessLogs
   

2. Check the status of the registration:

   Note

   The RegistrationState can be in the Registering state for up to 60 minutes before changing toRegistered. Wait until the status is Registered before continuing.

   Get-AzProviderFeature -ProviderNamespace Microsoft.NetApp -FeatureName ANFFileAccessLogs`
   

You can also use Azure CLI commands az feature register and az feature show to register the feature and display the registration status.

Supported regions

Availability for file access log is limited to the following regions:

• Australia Central
• Australia East
• Australia Southeast
• Brazil South
• Canada Central
• Canada East
• Central India
• Central US
• East Asia
• East US
• East US 2
• Japan East
• Japan West
• Korea Central
• Korea South
• North Europe
• South Central US
• Southeast Asia
• South India
• Switzerland North
• Switzerland West
• UK South
• West Europe
• West US
• West US 2
• West US 3

Set SACLs or Audit ACEs on files and directories

You must set SACLs for SMB shares or Audit ACEs for NFSv4.1 exports for auditing.

Enable file access logs

1. In the Volumes menu, select the volume you want to enable file access logs for.
2. Select Diagnostic settings from the left-hand pane.
3. Select + Add diagnostic setting.
4. In the Diagnostic setting page, provide a diagnostic setting name. Under Logs > Categories, select ANFFileAccess then set the retention period of the logs.
5. Select one of the destination options for the logs:
   • Archive to a storage account
   • Stream to an event hub
   • Send to Log Analytics workplace
   • Send to a partner solution
6. Save the settings.

Disable file access logs

1. In the Volumes menu, select the volume on which you want to disable file access logs.
2. Select the Diagnostic setting menu from the left-hand pane.
3. In the Diagnostic settings page, deselect Audit. This automatically deselects ANFFileAccess.
4. Select Save.

Next Steps

• Security FAQs
• Azure resource logs
• Understand NFSv4.x access control lists in Azure NetApp Files
• Understand SMB file permissions in Azure NetApp Files