What SnapLock logging is

SnapLock logging is an infrastructure for logging SnapLock events. The SnapLock events are recorded in the SnapLock log file.

Following are the properties of SnapLock log files:

The log files are protected from tampering. They are not writable by any external applications.
SnapLock log files are WORM files that reside on a SnapLock Compliance volume.

Note: In SnapLock logging, you cannot delete the log files until their retention period expires. The retention period of the SnapLock log file is derived from the events that are logged in. The minimum and default retention period of the log file is six months. You can determine the default retention period by using the option snaplock.log.default_retention.

When a new record is added in the log file, the retention period of the log file is modified. The retention period of the log file is compared with the retention period of the new event logged in the file. If the retention period of the logged event exceeds, the retention period of log file is made equal the retention period of the logged event.

In case of privileged delete record, the retention period is derived from the file that is deleted. For other events (addition or deletion of compliance users,enabling or disabling privileged delete feature, and change of log volume),the rentention period is equal to the value obtained from options snaplock.log.default_retention.

A SnapLock log file name contains a base name along with starting date and time, and closing date and time. For example, priv_delete.20080825_161858_GMT-20080826_121346_GMT. However, for the active log files, the names do not have an end time specified, for example, system_log.20080909_131521_GMT-present

You can use the SnapLock logging for any audits or log. The SnapLock logging is useful for privileged delete operations.

Types of SnapLock log files
SnapLock log files are of two types, system_log and priv_delete.
Advantages of SnapLock logging
The SnapLock logging has several advantages.
Limitations of SnapLock logging
SnapLock logging has certain limitations.
Assigning a SnapLock log volume
Assigning a SnapLock log volume creates the system_log file in the volume. The system_log file stores the system-related SnapLock events such as the addition of the compliance user or a change to the SnapLock log volume.
How archiving a log file works
Archiving a file means committing the log file to the WORM state. You cannot use a log file after it is archived.
Archiving log files
You can archive a single active log file or all active log files on a volume.
Finding the status of the SnapLock log file
You can get the status of either a single active SnapLock log file or all log files in a volume.
What the SnapLock log file contains
When an unexpired SnapLock file is deleted, an entry is made to the log file. The log file captures all information about the SnapLock file.
Upgrade and revert considerations for SnapLock logging
If you upgrade to Data ONTAP 7.3.1 with support for the SnapLock logging feature, you will have access to new configurable options and commands required for this feature.

Related concepts

What the privileged delete feature is