UNSOLVED

stevef122

updated

8 years ago

S

stevef122

2 Posts

0

1754

October 31st, 2018 08:00

Storage API PowerShell SDK SACL Auditing Events

Anyone know how to dump the SACL Auditing Events using the PowerShell SDK on a FluidFS cluster? I have auditing configured and working on a FS8600 NAS volume through Storage Manager (version 2018 R1.10). The events are viewable in Storage Manager on the cluster's (version 6.0.300135) Client Activity - SACL Auditing Events page. I am trying to script the download of these events to a file so it can be automated. I am using the PowerShell SDK 4.1.0.47, but cannot seem to find the cmdlet to get the job done.

Thanks.

  • DELL-Bob Mi

    2 Intern

    230 Posts

    1651

    0

    Posted October 31st, 2018 11:00

    Hello stevef122,
    I use PowerShell ISE so I can look for key words from the DellStorage.ApiCommandSet. I have also scripted the Help Files for each command in API to be able to look at options:

    Import-Module "C:\API\DellStoragePowerShellSDK-4.1.0.47\DellStorage.ApiCommandSet.psd1"
    $user = " "
    $em = " "
    $pass = ConvertTo-SecureString "" -AsPlainText -Force
    $conn = Connect-DellApiConnection -HostName $em -User $user -password $pass
    $CMD = Get-Command -Module DellStorage.ApiCommandSet

    foreach ($line in $CMD)
    {
    Write Host $line
    $line | %{Get-Help $_.Name -Detailed} | Out-File C:\API\4.1.0.47_help\$line.txt
    }

    I have also found I can search the directory for key words.

    I show 3 commands that may be useful for you:
    NAME     New-DellFluidFsAuditServer
    SYNOPSIS     File access notification subscriber settings for auditing
    SYNTAX    FluidFsAuditServer -Hostname -Status [ ]

    NAME    New-DellFluidFsSmbShareSecurityDescriptorSacl
    SYNOPSIS    Security access control list

    NAME    Get-DellFluidFsFileAccessNotificationSubscriber

    Unfortunately I do not have access to an FS8600 currently so I cannot test this myself. Please let me know if this answers your query.

  • stevef122

    2 Posts

    1631

    0

    Posted November 1st, 2018 07:00

    Thanks Bob. Unfortunately they did not help. So far, all I've found is the Get-DellFluidFsClusterEmEvent cmdlet, which dumped the cluster events, but the SACL auditing events were not included in its output.

  • StorageWind

    1 Message

    1045

    0

    Posted June 13th, 2019 07:00

    # Creating filter
    $filter = [DellStorage.Api.Enums.FilterTimeEnum] "other"
    #DellScVolumeHistoricalIoUsage -Instance $volume.InstanceId -HistoricalFilter $filter

    $startdate = (Get-Date).AddHours(-24)

    $finishdate = (get-date)

    $lasthour = New-DellHistoricalFilter -FilterTime $filter -StartTime $startdate -EndTime $finishdate

    Get-DellFluidFsClusterEmEvent -Instance "your cluster instanceID" -HistoricalFilter $lasthour -Severity 1