Deleting Audit Log

Hello Neesha,

Usually, retaining the audit logs is something that is mandated by a specific security or compliance act that is being followed; should you not be bound by either of these, or you have your logs moved elsewhere and that satisfies the requirement, you can remove them from the Isilon cluster.

As of right now, this procedure is support only due to it's potential to affect SMB/NFS access to your cluster. The amount of space reclaimed would be 100% dependent on how many logs you have stored. If you are on OneFS 7.1 and later (the supported versions of OneFS) you are storing logs in /ifs/.ifsvar/audit/logs. If you run the following command, you can estimate space being used by these logs:

test-cluster-4# du -sh /ifs/.ifsvar/audit/logs

7.2G    /ifs/.ifsvar/audit/logs

On my test cluster, we have very little, but you may have more. If you are also storing logging within syslog, this should be regulated by your syslog configuration. If you do want to clear the logging, i would open a support case. To create a service request, you have a few options:

1. Log in to your online account on support.emc.com and go to this page: https://support.emc.com/servicecenter/createSR
2. 2. Engage an Isilon Support engineer directly through Live Chat Support: https://support.emc.com/servicecenter/liveChat/
3. 3. Call in to EMC Isilon Support at 1-800-782-4362 (For a complete local country dial list, please see this document: http://www.emc.com/collateral/contact-us/h4165-csc-phonelist-ho.pdf)