Highlighted
stevef122
1 Copper

Storage API PowerShell SDK SACL Auditing Events

Anyone know how to dump the SACL Auditing Events using the PowerShell SDK on a FluidFS cluster? I have auditing configured and working on a FS8600 NAS volume through Storage Manager (version 2018 R1.10). The events are viewable in Storage Manager on the cluster's (version 6.0.300135) Client Activity - SACL Auditing Events page. I am trying to script the download of these events to a file so it can be automated. I am using the PowerShell SDK 4.1.0.47, but cannot seem to find the cmdlet to get the job done.

Thanks.

Labels (5)
0 Kudos
3 Replies
DELL-Bob Mi
3 Argentium

Re: Storage API PowerShell SDK SACL Auditing Events

Hello stevef122,
I use PowerShell ISE so I can look for key words from the DellStorage.ApiCommandSet. I have also scripted the Help Files for each command in API to be able to look at options:

Import-Module "C:\API\DellStoragePowerShellSDK-4.1.0.47\DellStorage.ApiCommandSet.psd1"
$user = " "
$em = " "
$pass = ConvertTo-SecureString "" -AsPlainText -Force
$conn = Connect-DellApiConnection -HostName $em -User $user -password $pass
$CMD = Get-Command -Module DellStorage.ApiCommandSet

foreach ($line in $CMD)
{
Write Host $line
$line | %{Get-Help $_.Name -Detailed} | Out-File C:\API\4.1.0.47_help\$line.txt
}

I have also found I can search the directory for key words.

I show 3 commands that may be useful for you:
NAME     New-DellFluidFsAuditServer
SYNOPSIS     File access notification subscriber settings for auditing
SYNTAX    FluidFsAuditServer -Hostname <string> -Status <FluidFsExternalServerState> [<CommonParameters>]

NAME    New-DellFluidFsSmbShareSecurityDescriptorSacl
SYNOPSIS    Security access control list

NAME    Get-DellFluidFsFileAccessNotificationSubscriber

Unfortunately I do not have access to an FS8600 currently so I cannot test this myself. Please let me know if this answers your query.

If my answer was helpful, please click: Kudos
Forum Member since 2012
#iwork4Dell
0 Kudos
stevef122
1 Copper

Re: Storage API PowerShell SDK SACL Auditing Events

Thanks Bob. Unfortunately they did not help. So far, all I've found is the Get-DellFluidFsClusterEmEvent cmdlet, which dumped the cluster events, but the SACL auditing events were not included in its output.

0 Kudos
StorageWind
1 Copper

Re: Storage API PowerShell SDK SACL Auditing Events

# Creating filter
$filter = [DellStorage.Api.Enums.FilterTimeEnum] "other"
#DellScVolumeHistoricalIoUsage -Instance $volume.InstanceId -HistoricalFilter $filter

$startdate = (Get-Date).AddHours(-24)

$finishdate = (get-date)

$lasthour = New-DellHistoricalFilter -FilterTime $filter -StartTime $startdate -EndTime $finishdate

Get-DellFluidFsClusterEmEvent -Instance "your cluster instanceID" -HistoricalFilter $lasthour -Severity 1

0 Kudos