Logger and CIFS share on a Windows 2008 R2 Server

ArcSightHere is a workaround for the issue with mounting a CIFS share (Windows 2008 R2 Server) at a Logger.
I followed usual procedure to configure a remote file system at a Logger.
All required parameters for CIFS share were specified:


Surprisingly it did not work:


I carefully checked parameters, login credentials – everything was correct. Furthermore, the same share was successfully mounted from another Linux box.

The next step was getting access to the Logger (via SSH) and checking logs:

[root]# dmesg -c
Status code returned 0xc000006d NT_STATUS_LOGON_FAILURE CIFS VFS:
Send error in SessSetup = -13 CIFS VFS: cifs_mount failed w/return code = -13

Well, “logon failure”… It is weird, since credentials are correct!

What I found later, the CIFS kernel component has some security settings are located in the file /proc/fs/cifs/SecurityFlags

By default a Logger has this flag is set to 0x7:

[root]# cat /proc/fs/cifs/SecurityFlags

This flag is the root cause of the problem – it is not compatible with Windows 2008 R2 Server. I had to change this flag to 0x81:

[root]# echo 0x81 > /proc/fs/cifs/SecurityFlags

Now try again to mount the CIFS share:





1 thought on “Logger and CIFS share on a Windows 2008 R2 Server”

  1. Hi Alex,

    I have similar issue while configuring 2012R2 on RHEL 7.2 via CIFS for softeware logger v6.3.1. It says Logger cannot write to that location. infact i m able to read & write the files directly from RHEL server.

    any idea?



Leave a comment