Issue with audit protocol loggind to syslog

Hi all,

I have another issue with my test environment on OneFS 8.1.0.0 ( on virtual machines ).

I'm trying to setup auditing for the test zone to a remote syslog.

I ( think ) have followed the configuration from almost every EMC doc around, but can't get the protocol audit sent out.

My config is, actually:

IsilonTest-1# isi audit settings global view              

Protocol Auditing Enabled: Yes

            Audited Zones: TestAccessZone

          CEE Server URIs: -

                 Hostname: -

  Config Auditing Enabled: Yes

    Config Syslog Enabled: Yes

IsilonTest-1# isi audit settings view --zone TestAccessZone

            Audit Failure: create, delete, rename, set_security, close

            Audit Success: create, delete, rename, set_security, close

      Syslog Audit Events: create, delete, rename, set_security

Syslog Forwarding Enabled: Yes

In /etc/mcp/override/syslog.conf I have added:

IsilonTest-1# cat /etc/mcp/override/syslog.conf

!audit_config

*.*                                             @10.100.20.5

!audit_protocol

*.*                                             @10.100.20.5

and if I look ( after some seconds ) in /etc/syslog.conf I see:

IsilonTest-1# cat /etc/syslog.conf | grep -A2 audit_

!audit_config

*.*                                             @10.100.20.5

!audit_protocol

*.*                                             @10.100.20.5

--

!audit_config

*.*                                             /var/log/audit_config.log

!audit_protocol

*.*                                             /var/log/audit_protocol.log

when looking at files in /var/log I see:

IsilonTest-1# isi_for_array -s "ls -l /var/log/audit_*"

IsilonTest-1: -rw-rw-r-- 1 root  wheel  3102 Apr 11 10:21 /var/log/audit_config.log

IsilonTest-1: -rw-rw-r-- 1 root  wheel    55 Dec 14 13:31 /var/log/audit_protocol.log

IsilonTest-2: -rw-rw-r-- 1 root  wheel  1689 Apr 11 10:21 /var/log/audit_config.log

IsilonTest-2: -rw-rw-r-- 1 root  wheel    55 Dec 14 12:46 /var/log/audit_protocol.log

IsilonTest-3: -rw-rw-r-- 1 root  wheel  55 Dec 14 12:46 /var/log/audit_config.log

IsilonTest-3: -rw-rw-r-- 1 root  wheel  55 Dec 14 12:46 /var/log/audit_protocol.log

that shows that audit_protocol is not even logging on files, while audit_config is.

The node where actually host the smartconnect IP for the zone is LNN 2 and if I do

IsilonTest-1# isi_audit_viewer -t protocol -n 2 | tail -5

[643: Wed Apr 11 11:41:16 2018] {"id":"7b19e800-3d6c-11e8-b4ae-005056a10781","timestamp":1523439676585795,"payloadType":"c411a642-c139-4c7a-be58-93680bc20b41","payload":{"protocol":"SMB2","zoneID":2,"zoneName":"TestAccessZone","eventType":"create","createResult":"OPENED","isDirectory":false,"desiredAccess":128,"clientIPAddr":"10.100.8.120","createDispo":1,"userSID":"S-1-5-21-4173488626-1412151292-1632754385-500","userID":1000001,"fileName":"\\ifs\\TestAccessZone\\AllShares\\OkShare1\\Shares\\sharedup.exe","ntStatus":0,"fsId":1,"partialPath":"OkShare1\\Shares\\sharedup.exe","rootInode":4296572238,"inode":4298186570}}

[644: Wed Apr 11 11:41:16 2018] {"id":"7b1a1205-3d6c-11e8-b4ae-005056a10781","timestamp":1523439676586862,"payloadType":"c411a642-c139-4c7a-be58-93680bc20b41","payload":{"protocol":"SMB2","zoneID":2,"zoneName":"TestAccessZone","eventType":"close","isDirectory":false,"clientIPAddr":"10.100.8.120","fileName":"\\ifs\\TestAccessZone\\AllShares\\OkShare1\\Shares\\sharedup.exe","userSID":"S-1-5-21-4173488626-1412151292-1632754385-500","userID":1000001,"bytesRead":0,"bytesWritten":0,"numberOfReads":0,"numberOfWrites":0,"ntStatus":0,"fsId":1,"partialPath":"OkShare1\\Shares\\sharedup.exe","rootInode":4296572238,"inode":4298186570}}

[645: Wed Apr 11 11:41:16 2018] {"id":"7b1a5472-3d6c-11e8-b4ae-005056a10781","timestamp":1523439676588563,"payloadType":"c411a642-c139-4c7a-be58-93680bc20b41","payload":{"protocol":"SMB2","zoneID":2,"zoneName":"TestAccessZone","eventType":"create","createResult":"OPENED","isDirectory":false,"desiredAccess":1179785,"clientIPAddr":"10.100.8.120","createDispo":1,"userSID":"S-1-5-21-4173488626-1412151292-1632754385-500","userID":1000001,"fileName":"\\ifs\\TestAccessZone\\AllShares\\OkShare1\\Shares\\sharedup.exe","ntStatus":0,"fsId":1,"partialPath":"OkShare1\\Shares\\sharedup.exe","rootInode":4296572238,"inode":4298186570}}

[646: Wed Apr 11 11:41:27 2018] {"id":"8180e212-3d6c-11e8-b4ae-005056a10781","timestamp":1523439687326988,"payloadType":"c411a642-c139-4c7a-be58-93680bc20b41","payload":{"protocol":"SMB2","zoneID":2,"zoneName":"TestAccessZone","eventType":"close","isDirectory":false,"clientIPAddr":"10.100.8.120","fileName":"\\ifs\\TestAccessZone\\AllShares\\OkShare1\\Shares\\sharedup.exe","userSID":"S-1-5-21-4173488626-1412151292-1632754385-500","userID":1000001,"bytesRead":22528,"bytesWritten":0,"numberOfReads":8,"numberOfWrites":0,"ntStatus":0,"fsId":1,"partialPath":"OkShare1\\Shares\\sharedup.exe","rootInode":4296572238,"inode":4298186570}}

done

so the audit_protocol is ( at least ) loggin to the internal viewer.

When looking at the syslog server ( 10.100.20.5 ) I can see messages from the cluster reguarding the audit_config but not the audit_protocol, so at least a minial part of my configuration seems to be fine.

What I'm doing wrong ?

Thanks in advance

Pierluigi