File Auditing in isilon

explore isi_audit_viewer command

Thanks,

Can you get me the guide where i can get the commands to explore auditing commands with examples. Since i am new to this array i need the doc. Thank you very much for your support!!

Sathish_Chanti,

"isi_" commands are considered internal (Support commands) and have no documentation beyond the --help page supplied from the CLI:

Only two exceptions I can find are: isi_for_array, isi_gather_info these two commands have outlines in the CLI Admin guide for the respective OneFS version.

milpool-2# isi_audit_viewer --help

isi_audit_viewer: illegal option -- -

Usage: isi_audit_viewer [ -n | -t | -s |

         -e | -v ]

         -n : Specify node id to browse (default: local node)

         -t   : Choose topic to browse.

            Topics are "config" and "protocol" (default: "config")

         -s   : Browse audit logs starting at

         -e     : Browse audit logs ending at

         -v verbose  : Prints out start / end time range before printing

             records

            Start and End times are expressable as a

             date format "YYYY-MM-DD HH:MM:SS", where

             fields represent year/month/day/hours/minutes/seconds.

            Time can also be expressed as HH:MM:SS;

             in this case the date is set to the current day.

            Time prefixes can also be used, in which case missing values are

             assumed to be 0.

             E.g. "05:15" represents "05:15:00".

            If not specified, end time defaults to now and

             start time to 24 hours before end time.

Keep in mind these audit logs are held per node, so running the isi_aduit_viewer command on node 1 for someone connected to node 3 will not yield any results.

this assumes that you have auditing enabled

Hi Shane,

Thanks for your response.

Do you have any idea of Isilon Audit logging integration with SUMOLOGIC.

In reviewing the Sumologic web pages, it appears to have the ability to accept messages via Syslog. In that case, you can setup the Isilon to forward audit events via syslog.

Page 12 of the following documents provide an example of setting up syslog forwarding for audit events

http://www.emc.com/collateral/white-papers/h12428-wp-best-practice-guide-isilon-file-system-auditing.pdf

This guide may prove useful to you: https://support.emc.com/docu50353_White-Paper:-File-System-Auditing-with-EMC-Isilon,-EMC-CEE,-and-Varonis-DatAdvantage.p…