PowerScale Audit Log Shows 127.0.0.1 for S3

If you use PowerScale's Audit functions (isi_audit) with S3 buckets, a specific functionality is triggered. It causes some internal S3 operations to appear with 127.0.0.1 as the client IP address. This is a known issue found initially in OneFS 9.7.

The 127.0.0.1 client IPs for some transactions represent the OneFS node in question itself. Each node for S3 has to perform maintenance work involving files used with S3 buckets. When paired with Audit, it can have the side effect of your audit log payloads showing as a 127.0.0.1 client. These are different from the proper audited Protocols actions, such as SMB, NFS, or HDFS, which still record correctly from your client's IP addressed. The 127.0.0.1 entries are 'extra', due to the issue, and represent internal maintenance of S3 content. The future fix eliminates these 127.0.0.1 entries and the unnecessary recording of these internal actions.

Here is an example such payload string:

ISI01-3: [1517065: Mon Jul 21 09:02:43 2025] {"id":"50e107ca-65f8-11f0-9327-f8f21e3acdbc","timestamp":1753077763170507,"payloadType":"c411a642-c139-4c7a-be58-93680bc20b41","payload":{"protocol":"S3","zoneID":1,"zoneName":"System","eventType":"create","detailType":"open-directory","createResult":"OPENED","isDirectory":true,"desiredAccess":32,"clientIPAddr":"127.0.0.1","createDispo":1,"userSID":"S-1-5-18","userID":0,"fileName":"\\ifs\\S3-ZONE\\xdr-common-loki\\index\\delete_requests","ntStatus":0,"fsId":1,"inode":4775883127,"S3OP":"put-object"}}

Note the bold red 127.0.0.1 area. Again, your true client-based actions are recording fine meanwhile. 

Audit systems incorrectly record these internal actions that are maintenance noncustomer facing upkeep work on managing S3 content.

This is fixed in a forthcoming OneFS release and has been confirmed as a defect.