You can use the < show-events > CLI command to accomplish the task outlined below with a category type of < audit >; show-events category=audit.

We have this command documented on page 430 of the XtremIO User Guide. Specifically, the following entry will be displayed to the terminal based upon the thread owner’s request:

----

294284   2015-11-21 15:09:33 50001      5000100            audit    information None       None   None           User: tech, Command: unmap_lun, Arguments: {vol_obj_id=["03504a18a576477e91015322e5aca2ff", "Dave", "4"], tg_obj_id=["f096edff29e84ff7bcd43fcee510098d", "Default", "1"], ig_obj_id=["70971e6a41ae42f7a09e28abcb059def", "LG4-M3", "1"], lun=1, all=False, lm_id=["f25861765c9f40a48450a55e7f8e2504", "4_1_1", "2"], sys_id=["c4ce54e23bec4efb93c46f26b7b0d1e0", "xbrickhpk2-3", "1"]}

-----

A similar message can be seen within the XtremIO GUI on the < Alerts & Events > tab.

so, that returns activities up until 11/17 17:10. I need events from 11/16. I do have dossier logs taken on 11/18 that hopefully captured the data but how would I review them?

The dossier files are meant to be analyzed by the EMC Support.

Are you saying that you are not able to see any events from a week back?

i do have a SR open with EMC and they are reviewing the logs.

when I ran the event query, I only obtained entries up until the 17th, thus was hoping to review the logs in the dossier archive for older date/time events.