PowerScale OneFS 9.8.0.0 Web Administration Guide

Configuration change auditing

Configuration change auditing tracks and records all configuration events from the OneFS platform API. The process audits the command-line interface (CLI), web administration interface, and OneFS APIs.

Configuration change logs are populated in the config topic in the audit back-end store under /ifs/.ifsvar/audit/logs/node<nnn>/config. The logs automatically roll over to a new file after the size reaches 1 GB.

You can enable configuration auditing using the Web UI or the CLI. If you enable configuration auditing, no additional configuration is required. You can optionally configure syslog forwarding using the CLI.

Protocol auditing

Protocol auditing tracks and stores activity through SMB, NFS, S3, and HDFS protocol connections. You can enable and configure protocol auditing for one or more access zones in a cluster. If you enable protocol auditing for an access zone, file-access events through the SMB, NFS, S3, and HDFS protocols are recorded in the protocol audit topic directories. You can specify which events to log in each access zone. For example, you can audit the default set of protocol events in the System access zone but audit only successful attempts to delete files in a different access zone.

The audit events are logged on the individual nodes where the SMB, NFS, S3, or HDFS client initiated the activity. The events are stored in a binary file under /ifs/.ifsvar/audit/logs/node<nnn>/<protocol>. The logs automatically roll over to a new file after the size reaches 1 GB. The logs are compressed to reduce space.

The protocol audit logs are consumable by auditing applications that support the Common Event Enabler (CEE).

You can enable protocol auditing using the Web UI or CLI. To configure syslog forwarding, use the CLI.

System auditing

System auditing tracks system platform events and events that are related to account management. Two services manage system auditing. Both services log events per node. Both services manage their own log rotations and rollovers. The two system auditing services are syslogd and OpenBSM.

• The syslogd service collects logs that are generated by other applications and stores them in /var/log/audit/<audit files>. The syslogd service is always enabled and cannot be disabled. It collects audit logs from the following application logs.

  Table 1. Application LogsThe following table describes each application log.

  Application log	Description
  isi_pw.log	Logs account changes that were made with the isi_pw command.
  pw.log	Logs account changes that were made with the pw command.
  auth.log	Logs authentication events.
  httpd.log	Logs access to the HTTP server.

• The OpenBSM service is predefined to log high-level cluster events. This service is disabled by default. If enabled, it collects the following events and stores them in /var/audit/<audit files>.
  • Module loads and unloads
  • System boot up and reboots
  • User logins and logouts
  • System shutdowns and power off
  • OpenSSH logins

Use the CLI to configure system auditing. You can enable and disable the OpenBSM service. You can configure forwarding of all system auditing logs from both services to remote syslog servers.