OneFS: Auditing Does Not Update When Node LNNs Are Changed

Summary: Auditing doesn't use the new Node LNNs when they're changed, and will continue to write to existing audit event logs using old Node LNNs

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

 

  • When the LNNs are changed on the cluster, the auditing service doesn't use the new assignments. 
  • New audit event logs will not be created in /ifs/.ifsvar/audit/logs/ for the new Node LNN assignments.
  • The auditing will continue to use old Node LNN directories, for writing events to audit event logs in the /ifs/.ifsvar/audit/logs/ directory.
  • If a new node is added to the cluster, and it inherits a LNN that was previously assigned to another node, it will append new events to existing audit event logs in /ifs/.ifsvar/audit/logs/ directory for the LNN it was assigned.
  • If the auditing doesn't get refreshed to use the new LNN assignments, and a new node is added and uses the LNN that still being used by the old node, both nodes will append new audit event entries to the log in /ifs/.ifsvar/audit/logs/.

Cause

This is currently tied to the sensitive nature of the audit service.  If the audit service is improperly interrupted, it can cause workflow disruptions to the node(s) in question, resulting in users losing access to SMB and/or NFS access on the node(s).

Resolution

Please reach out to PowerScale support for assistance with resolution quoting this KB.

Affected Products

Isilon, PowerScale OneFS
Article Properties
Article Number: 000035925
Article Type: Solution
Last Modified: 26 Nov 2025
Version:  6
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.