PowerScale OneFS 9.8.0.0 Web Administration Guide

Audit log purging

OneFS supports audit log purging features on the cluster.

The audit system writes audit logs in the /ifs/.ifsvar/audit/logs directory. After an audit log file reaches 1G, a new file is created, and the old file is compressed. As time goes on, the audit log file exhausts all space on the file system.

There are two ways to delete audit logs. Both methods are performed using the command-line interface.

In the first method, automatic deletion, the audit logs are deleted automatically after passing a specified retention period.

The retention period works like a window. Any audit log out of the window is deleted. For example, if you configure the retention period as 90 days, and the current date is 2019-5-30, any log before 2019-3-1 is deleted. From 2019-3-1 to 2019-5-30 is a 90 day window. The granularity of deleting is by file. Although audit log purging uses day to determine the retention period, purging removes a file when the last audit event in the file is older than the retention period.

The second purging method is manual deletion. You can specify to delete audit logs before a specified time.

Both automatic and manual deletion apply to configuration change and protocol activity logs.