CONTAP-636112: Anti-Ransomware Commands Fill the Audit Log

Primary item: NetApp Knowledge Base — CONTAP-636112. This is a technical issue record, not a press release.

What NetApp announced

NetApp has listed CONTAP-636112 under ONTAP file-system issues with the title “Anti-Ransomware Commands Fill the Audit Log.” The public category page dates the entry 21 October 2026. That is the full public product claim: activity associated with anti-ransomware commands can consume the administrative audit log.

The wording does not identify which commands cause the growth, whether the source is CLI, REST or an internal workflow, how quickly the log fills, or which ONTAP releases are affected. It also does not publish a fix or workaround. In particular, the title alone does not justify disabling ARP/AI, suppressing audit records, or claiming that ransomware detection itself has failed.

Why an audit-log flood matters

ONTAP writes management activity to /mroot/etc/log/mlog/audit.log on each node. NetApp documents that the file rotates every day or when it reaches 100 MB; ONTAP retains the previous 48 copies, for no more than 49 files. Size-triggered rotation emits an EMS message, while routine daily rotation does not.

That makes CONTAP-636112 an observability and evidence-retention problem even if the ARP command completes successfully. Repeated records can push older administrative activity through the finite rotation window sooner than expected and add noise when an operator is reconstructing who issued a request and when. NetApp also documents that management audit activity is included in standard AutoSupport reports. This issue is not evidence that the data volume is full: the named object is the ONTAP management audit log.

The site's ONTAP audit and event logging reference separates this cluster-administration trail from NAS file-access auditing and EMS events—three streams that should not be conflated during an incident.

What ONTAP operators can verify safely

Start with read-only inspection. NetApp documents these commands at admin privilege:

security audit show
security audit log show

security audit show reports whether CLI, HTTP and ONTAPI GET requests are being audited. security audit log show displays cluster-wide entries from multiple nodes in chronological order. Capture the current audit settings, the time window, node, application, user, state and input around the growth before changing anything.

SET operations—such as create, modify and delete requests—are logged by default. GET operations, including CLI show requests, are not logged by default; they can be enabled separately with the -cliget, -httpget and -ontapiget controls. If a site has enabled GET auditing, record that configuration as a possible volume multiplier, but do not present it as the cause of CONTAP-636112: NetApp's public issue text does not establish that connection.

What changes for customers

• ONTAP: treat unusually fast audit rotation during ARP administration as a known-issue signal. Preserve representative entries and the rotation EMS event, then open a NetApp support case with CONTAP-636112. Do not disable audit coverage or ARP/AI solely from the public title.
• Cloud Volumes ONTAP: it runs ONTAP, but the public record contains no platform matrix. Check the authenticated issue record and the exact deployed release before assuming inclusion or exclusion.
• StorageGRID: the issue is categorized under ONTAP and names ONTAP anti-ransomware commands. No StorageGRID audit or object-storage behavior is announced.
• BlueXP / NetApp Console: no console feature, API change or remediation is published. If an action originates in a management interface, correlate its timestamp and user with the ONTAP audit entry rather than assuming the interface is the defect.

Do not trade away the evidence

NetApp exposes security audit modify controls for GET auditing, but a configuration change is not a published CONTAP-636112 workaround. Before considering one, confirm why GET auditing was enabled, whether policy requires it, and whether secure forwarding already protects the retention window. NetApp specifically recommends log forwarding when GET auditing could produce rapid rotation.

A safer interim pattern is to preserve evidence externally, measure rotation frequency, and narrow any automation loop that repeatedly invokes an ARP command only when the command caller and operational purpose are known. Avoid deleting rotated files or changing security controls merely to make the symptom disappear.

What to watch next

• The authenticated affected-version and fixed-version fields for CONTAP-636112.
• NetApp identification of the exact ARP command family and whether CLI, REST, System Manager or internal calls are involved.
• A maintenance-release note or public workaround tied to the issue ID.
• Clarification of whether the defect creates duplicate audit entries, an unexpectedly large entry, or an unexpectedly frequent command loop.

Until NetApp publishes those specifics, the defensible response is bounded: verify the audit configuration, preserve a small representative sample and rotation evidence, protect retention through existing forwarding, and use CONTAP-636112 when engaging support.

Sources: NetApp Knowledge Base — CONTAP-636112; NetApp ONTAP documentation — audit logging implementation; NetApp ONTAP command reference — security audit modify; NetApp ONTAP command reference — security audit log show.