How can I delete an FSx for ONTAP volume that’s configured to hold audit logs?

Short description

If you try to delete an FSx for ONTAP volume that contains audit logs, then you receive the following error:

"Cannot delete the volume because it is configured to hold audit logs for Vserver. Run the Vserver audit modify command using the ONTAP CLI to change the audit destination, and try again."

Resolution

1.    You can't delete volumes that contain audit logs. To determine if auditing is turned on for a volume, run the following command:

::> vserver audit show  -ins      vserver audit show  -ins      

                           Vserver: svm-src
                    Auditing State: false
              Log Destination Path: /restored
     Categories of Events to Audit: file-ops, cifs-logon-logoff,
                                    audit-policy-change
                        Log Format: evtx
               Log File Size Limit: 200MB
      Log Rotation Schedule: Month: -
Log Rotation Schedule: Day of Week: -
        Log Rotation Schedule: Day: -
       Log Rotation Schedule: Hour: -
     Log Rotation Schedule: Minute: -
                Rotation Schedules: -
          Log Files Rotation Limit: 0
            Log Retention Duration: 0s
      Strict Guarantee of Auditing: true

2.    To turn off auditing on the volume, run the following command. Replace vserver-name with the your Vserver name.

::> vserver audit disable -vserver vserver-name

3.    To change the audit destination to another volume, run the following command. Replace destination-volume-name with your destination volume's name.

::> vserver audit modify -destination destination-volume-name

4.    To delete the volume, run the following commands. Replace vserver-name and volume-name with your Vserver name and volume name.

::> volume modify -vserver vserver-name -volume volume-name -state offline
::> volume delete -vserver vserver-name -volume volume-name

Note: You can also use the Amazon FSx console, AWS Command Line Interface (AWS CLI), or Amazon FSx API to delete the volume. For more information, see Deleting a volume.