How do you get to the hidden ssh / ftp logs under /.etc?

Question

This page lacks the essential information of how to get to those logs, what they are named, and what the options are for relocation...

https://emc--c.na5.visual.force.com/apex/KB_HowTo?id=kA0700000004TGP

Enabling logging for our use of FTPS on a VNX5600 seems pretty straightforward. Using the server_extlog utility to enable it but how do you get to that hidden log directory to see what there is to "get" with server_file? Or, is there some other command you need to view the audit logs? The manual for using FTP, TFTP, and SFTP on the VNXs only tells you how to enable it, yet no manual that I can find explains how you can watch these logs or pull them down. The other thing is trying to redirect the logs so they don't fill root. What are the options here? Can you redirect the audit logs to a filesystem exported like any other NAS FS?

thanks

umichklewis · Answer

With the serverext_log command, you can have the datamover write to the log to a different directory.

For example, if you want all SSH, SFTP and SCP activity logged to a filesystem named fs01, in a "SSH_logs" directory, you can use server_extlog server_2 -service ssh -modify -dir /fs01/SSH_logs to redirect the log info to that directory. Then, you can export this subdirectory via NFS or CIFS, whichever you choose. You'll be able to quickly and easily browse the logs from another workstation.

Let us know if that helps!

Karl

umichklewis · Answer

I should also add, for security reasons, it's probably a good idea to put the logs on a different filesystem than the FTP/SFTP share. This should reduce the chances of users being able to delete or modify the logs.

Good luck!

umichklewis · Answer

You can get to the .etc directory on any filesystem in one of two ways - 1) You can export the root filesystem in question via NFS or CIFS.  The .etc directory will be visible to NFS and CIFS clients, and you can browse the folder.  If you have root or admin privileges, you can also delete or modify this directory (hence my note above). 2) You can access any mounted filesystem on a Celerra via the hidden back-end path from the Control Station, without even exporting the filesystem via NFS or CIFS.  Sometimes, EMC documentation is written in a way that this hidden access path doesn't exist, but Support staff and experienced users know about it and use it as-needed. If you've never used the hidden path, search the Community forums or message me. Good luck! Karl

downhill2 · Answer

Yeah, that works fine. And, ok, so I guess it is just one of those implied tasks then, since if there is no way to "get" the logs off of the hidden directory on the root FS, then one is encouraged to specify some other place for the logs to be dumped. Why don't they update that article then (or hey - what an even grander idea: update the command line and FTP manuals)?!

thanks Karl

SKT2 · Answer

paths like /nas/quots/slot_2/.etc/log

Rainer_EMC · Answer

you can also just use ftp to download the logs

VNX

How do you get to the hidden ssh / ftp logs under /.etc?

Was this post helpful?