Home > Storage > PowerScale (Isilon) > Product Documentation > Security and Compliance > Dell PowerScale: Answers to Common Questions about Audit/Syslog > Can you still track the protocol events when its audit log has been stopped?
No matter whether the audit log is enabled or disabled, you can query all the SMB protocol access information using the /var/log/lwiod.log file.
In the following example, I disable the protocol access audit log and then create a new folder called “audit test” in an SMB file share. In the /var/log/lwiod.log file, you can find the following entries:
Lwiod.log for SMB operations
For NFS, you can query /var/log/nfs.log for the information.
For HDFS, you can query /var/log/hdfs.log for the information.
Note: nfs.log and hdfs.log are slightly different from lwiod.log, and less informative.