File Access Auditing on VNX for File (CIFS/NFS)

Question

Hi,

Can anyone direct me at document or other resources that describe the methods available to access to file access audit logging for VNX. I understand that for CIFs it could be possible to use WMI to pull the data from the Datamover. But, is there a easy (robust) method for doing similar and how can I do the same on NFS shares? I already have software capable of reading a log and processing it (SPLUNK) so do need a complete solution.

Regards,

Gareth

Rainer_EMC · Answer

Hi Gareth,

currently the only way to do NFS auditing is through the VNX Event Enabler API – see the “Using VNX™ Event Enabler” manual.

It’s a programmatic API – not something that you can just use with the CLI.

We have partners like Varonis that have integrated with it for NFS auditing.

Rainer

Rainer_EMC · Answer

Please see the CIFS manual

For CIFS auditing we work exactly like a Windows server – you can get the auditing events in an .evt file that is compatible with Windows Event Viewer – not a text file

Or with the VEE API

GarethR1 · Answer

What about just CIFS servers? Is there a simple way to get the data in a txt file etc. I already have a system capable of processing this kind of data. Regards, Gareth

eli_sowar · Answer

Have you found people reporting problems with not being able to point splunk at CIFS servers for event logs?

Rainer_EMC · Answer

No change there in terms of CIFS audit log access

ayas · Answer

Hi there ... not sure about splunk business .... sorry ....

NOW my question is ...... Codes has been upgraded since April 2013 ....does anybody know Audit log situation

has not been changed since then?

My customer wants to use CLI to get audit log from CS ... can he ?

thanks

aya

ayas · Answer

hi thank you for the info! Still Audit log in CIFS is available only from MMC ..

Rainer_EMC · Answer

You should be able to use Windows command line tools as well or 3rd party products that access the security.evt via CIFS

VNX

File Access Auditing on VNX for File (CIFS/NFS)

Was this post helpful?