Isilon not sending protocol audit events to CEE

Question

I'm only receiving empty heartbeat messages from isilon in CEE server -

How do I receive actual protocol audit events like the ones logged in Isilon -

{"id":"9b749409-7f5d-11ec-a822-xxx","timestamp":1643280055843745,"payloadType":"c411a642-c139-4c7a-be58-93680bc20b11","payload":{"protocol":"NFS","zoneID":1,"zoneName":"System","eventType":"close","detailType":"close-file-unmodified","isDirectory":false,"clientIPAddr":"10.xx.xxx","fileName":"\\ifs\\nfs_export\\tu","userSID":"S-1-22-xxx","userID":0,"bytesRead":0,"bytesWritten":0,"numberOfReads":0,"numberOfWrites":0,"ntStatus":0,"fsId":1,"partialPath":"tu","rootInode":4295099xx,"inode":4295035xxx}}

PS - Just getting started with isilon and CEE

DELL-Sam L · Answer

Hello dolap, Which Isilon system do you have, & what is your current OneFS version?

dolap · Answer

I'm using PowerScale OneFS 9.4.0.0. I can see the following events in CEE log file. Just not sure how to interpret it. I can see the number of writes is 1 but how do I get the file name that's being modified?

DELL-Sam L · Answer

Hello dolap, Here is a link to the PowerScale OneFS Web Administration Guide & if you look at chapter 12 it explains more about CEE and how t works with auditing. https://dell.to/35xe7bu

Isilon

Isilon not sending protocol audit events to CEE

Was this post helpful?