Saving Netapp CIFS audit logs to file

From the command line of filer:

1. Putty into filer
2. Enter the following command to update the event log:

cifs audit save [-f]

The -f option allows you to overwrite the existing event log. If the event log does not exist, you can omit the -f option

Reference:
https://library.netapp.com/ecmdocs/ECMP1196993/html/GUID-E58BC8F8-15B9-404F-B097-FD6214E1D409.html