PowerScaleOneFS CLI Command Reference

Syntax

isi audit settings global modify 
  [--protocol-auditing-enabled {yes | no}]
  [--audited-zones <zones>]
  [--clear-audited-zones]
  [--add-audited-zones <zones>]
  [--remove-audited-zones <zones>]
  [--cee-server-uris <uris>]
  [--clear-cee-server-uris]
  [--add-cee-server-uris <uris>]
  [--remove-cee-server-uris <uris>]
  [--hostname <string>]
  [--config-auditing-enabled {yes | no}]
  [--config-syslog-enabled {yes | no}]
  [--cee-log-time <string>]
  [--syslog-log-time <string>]
  [--config-syslog-servers <string>]
  [--clear-config-syslog-servers]
  [--add-config-syslog-servers <string>]
  [--remove-config-syslog-servers <string>]
  [--config-syslog-tls-enabled {yes | no}]
  [--config-syslog-certificate-id <string>]
  [--protocol-syslog-servers <string>]
  [--clear-protocol-syslog-servers]
  [--add-protocol-syslog-servers <string>]
  [--remove-protocol-syslog-servers <string> 
  [--protocol-syslog-tls-enabled {yes | no}]
  [--protocol-syslog-certificate-id <string>]
  [--system-syslog-enabled {yes | no}]
  [--system-syslog-servers <string>] 
  [--clear-system-syslog-servers]
  [--add-system-syslog-servers  <string>] 
  [--remove-system-syslog-servers  <string>]
  [--system-syslog-tls-enabled {yes | no}]
  [--system-syslog-certificate-id <string>]
  [--auto-purging-enabled {yes | no}]
  [--retention-period <integer>]
  [--system-auditing-enabled {yes | no}]
  [{--verbose | -v}]
  [{--help | -h}]

Options

--protocol-auditing-enabled {yes | no}

Enables or disables the auditing of data-access requests through the SMB, NFS, S3, and HDFS protocols.

--audited-zones <access zones>

Specifies one or more access zones, separated by commas, which will be audited if protocol auditing is enabled. This option overwrites all entries in the list of access zones; to add or remove access zones without affecting current entries, use --add-audited-zones or --remove-audited-zones.

--clear-audited-zones

Clears the entire list of access zones to be audited if protocol auditing is enabled.

--add-audited-zones <access zones>

Adds one or more access zones, separated by commas, to the list of zones that will be audited if protocol auditing is enabled.

--remove-audited-zones <access zones>

Removes one or more access zones, separated by commas, which will be audited if protocol auditing is enabled.

--cee-server-uris <uris>

Specifies one or more CEE server URIs, separated by commas, where audit logs will be forwarded if protocol auditing is enabled. The OneFS CEE export service uses round robin load-balancing when exporting events to multiple CEE servers. This option overwrites all entries in the list of CEE server URIs. To add or remove URIs without affecting current entries, use --add-cee-server-uris or --remove-cee-server-uris.

--clear-cee-server-uris

Clears the entire list of CEE server URIs to which audit logs are forwarded if protocol auditing is enabled.

--add-cee-server-uris <uris>

Adds one or more CEE server URIs, separated by commas, to the list of URIs where audit logs are forwarded if protocol auditing is enabled.

--remove-cee-server-uris <uris>

Removes one or more CEE server URIs, separated by commas, from the list of URIs where audit logs are forwarded if protocol auditing is enabled.

--hostname <string>

Specifies the name of the storage cluster to use when forwarding protocol events—typically, the SmartConnect zone name. When SmartConnect is not implemented, the value must match the hostname of the cluster as your third-party audit application recognizes it. If the field is left blank, events from each node are filled with the node name (clustername + lnn). This setting is required only if needed by your third-party audit application.

--config-auditing-enabled {yes | no}

Enables or disables the auditing of requests made through the API for configuration changes.

--config-syslog-enabled {yes | no}

Enables or disables the forwarding of configuration changes to remote syslog servers.

--cee-log-time <date>

Specifies a date after which the audit CEE forwarder will forward protocol access logs. Specify <date> in the following format:

[protocol]@<YYYY>-<MM>-<DD> <HH>:<MM>:<SS>

--syslog-log-time <date>

Specifies a date after which the audit syslog forwarder will forward logs. To forward SMB, NFS, and HDFS traffic logs, specify protocol. To forward configuration change logs, specify config. Specify <date> in the following format:

[protocol|config]@<YYYY>-<MM>-<DD> <HH>:<MM>:<SS>

--config-syslog-servers <string>

Specifies a list of remote servers to which config audit logs are forwarded. You must specify the --config-syslog-servers option for each server you want to add to the list.

Specify <string> in one of the following formats:

• <ip_address>
• <hostname>
• <ip_address>:<port>
• <hostname>:<port>

A custom TCP port can be specified by using the <ip_address>:<port> or the <hostname>:<port> format.

--clear-config-syslog-servers

Clears the list of remote servers to which configuration change audit logs are forwarded for logging in syslog.

--add-config-syslog-servers <string>

Adds servers to the list of remote servers to which configuration change audit logs are forwarded for logging in syslog. You must specify the --add-config-syslog-servers option for each additional server to add.

Specify <string> in one of the following formats:

• <ip_address>
• <hostname>
• <ip_address>:<port>
• <hostname>:<port>

A custom TCP port can be specified by using the <ip_address>:<port> or the <hostname>:<port> format.

--remove-config-syslog-servers <string>

Removes servers from the list of remote servers to which configuration change audit logs are forwarded for loggin in syslog. You must specify the --remove-config-syslog-servers option for each server to remove.

Specify <string> in one of the following formats:

• <ip_address>
• <hostname>
• <ip_address>:<port>
• <hostname>:<port>

A custom TCP port can be specified by using the <ip_address>:<port> or the <hostname>:<port> format.

--config-syslog-tls-enabled {yes | no}

Enables or disables TLS encryption of config audit logs for forwarding to remote syslog servers.

One- or two-way authentication is supported to establish the remote connection.

• One-way authentication verifies server side certificates. OneFS comes with embedded CA certificates that are used for this purpose. No additional configuration is required
• Two-way authentication verifies both server and client certificates. The server side certificate is the embedded certificate described above. For the client certificate, you must import the certificate into OneFS and identify it in the --config-syslog-certificate-id option.

--config-syslog-certificate-id <string>

Required only for two-way authentication for TLS connections to syslog remote servers .

The <string> is the ID or name of an imported certificate. See the isi audit certificates syslog import command for more information. The specified certificate is presented as the audit syslog forwarder's client certificate. The certificate ID has no effect if TLS is disabled.

--protocol-syslog-servers <string>

Specifies a list of remote servers to which protocol audit logs are forwarded. You must specify the --protocol-syslog-servers option for each server you want to add to the list.

Specify <string> in one of the following formats:

• <ip_address>
• <hostname>
• <ip_address>:<port>
• <hostname>:<port>

A custom TCP port can be specified by using the <ip_address>:<port> or the <hostname>:<port> format.

--clear-protocol-syslog-servers

Clears the list of remote servers to which protocol audit logs are forwarded for logging in syslog.

--add-protocol-syslog-servers <string>

Adds servers to the list of remote servers to which audit protocol logs are forwarded for logging in syslog. You must specify the --add-protocol-syslog-servers option for each server to add.

Specify <string> in one of the following formats:

• <ip_address>
• <hostname>
• <ip_address>:<port>
• <hostname>:<port>

A custom TCP port can be specified by using the <ip_address>:<port> or the <hostname>:<port> format.

--remove-protocol-syslog-servers <string>

Removes servers from the list of remote servers to which protocol audit logs are forwarded for logging in syslog. You must specify the --remove-protocol-syslog-servers option for each server to remove.

Specify <string> in one of the following formats:

• <ip_address>
• <hostname>
• <ip_address>:<port>
• <hostname>:<port>

A custom TCP port can be specified by using the <ip_address>:<port> or the <hostname>:<port> format.

--protocol-syslog-tls-enabled {yes | no

Enables or disables TLS encryption of protocol audit logs for forwarding to remote syslog servers.

One- or two-way authentication is supported to establish the remote connection.

• One-way authentication verifies server side certificates. OneFS comes with embedded CA certificates that are used for this purpose. No additional configuration is required
• Two-way authentication verifies both server and client certificates. The server side certificate is the embedded certificate described above. For the client certificate, you must import the certificate into OneFS and identify it in the --protocol-syslog-certificate-id option.

--protocol-syslog-certificate-id <string>

Required only for two-way authentication for TLS connections to syslog remote servers .

The <string> is the ID or name of an imported certificate. See the isi audit certificates syslog import command for more information. The specified certificate is presented as the audit syslog forwarder's client certificate. The certificate ID has no effect if TLS is disabled.

--system-syslog-enabled {yes | no

Enables or disables the forwarding of system audit logs to syslog remote servers.

--system-syslog-servers <string>

Specifies a list of remote servers to which system audit logs are forwarded. You must specify the --system-syslog-servers option for each server you want to add to the list.

Specify <string> in one of the following formats:

• <ip_address>
• <hostname>
• <ip_address>:<port>
• <hostname>:<port>

A custom TCP port can be specified by using the <ip_address>:<port> or the <hostname>:<port> format.

--clear-system-syslog-servers

Clears the list of remote servers to which system audit logs are forwarded for logging in syslog.

--add-system-syslog-servers <string>

Adds servers to the list of remote servers to which system events are forwarded for logging in syslog. You must specify the --add-system-syslog-servers option for each server to add.

Specify <string> in one of the following formats:

• <ip_address>
• <hostname>
• <ip_address>:<port>
• <hostname>:<port>

A custom TCP port can be specified by using the <ip_address>:<port> or the <hostname>:<port> format.

--remove-system-syslog-servers <string>

Removes servers from the list of remote servers to which system audit logs are forwarded for logging in syslog. You must specify the --remove-system-syslog-servers option for each server to remove.

Specify <string> in one of the following formats:

• <ip_address>
• <hostname>
• <ip_address>:<port>
• <hostname>:<port>

A custom TCP port can be specified by using the <ip_address>:<port> or the <hostname>:<port> format.

--system-syslog-tls-enabled {yes | no}

Enables or disables TLS encryption of system audit logs for forwarding to remote syslog servers.

One- or two-way authentication is supported to establish the remote connection.

• One-way authentication verifies server side certificates. OneFS comes with embedded CA certificates that are used for this purpose. No additional configuration is required
• Two-way authentication verifies both server and client certificates. The server side certificate is the embedded certificate described above. For the client certificate, you must import the certificate into OneFS and identify it in the --system-syslog-certificate-id option.

--system-syslog-certificate-id <string>

Required only for two-way authentication for TLS connections to syslog remote servers .

The <string> is the ID or name of an imported certificate. See the isi audit certificates syslog import command for more information. The specified certificate is presented as the audit syslog forwarder's client certificate. The certificate ID has no effect if TLS is disabled.

--auto-purging-enabled {yes | no}

Enables or disables automatic purging of older audit log files.

--retention-period <integer>

Purges audit log files older than the retention period. One day is the smallest unit available.

--system-auditing-enabled {yes | no}

Enables or disables the collection of system events by OpenBSM.

{--verbose | -v}

Displays the results of running the command.

{--help | -h}

Displays help for this command.