Veritas Data Insight Administrator's Guide

To configure and view audit settings on Isilon using the OneFS CLI

1. Log on to the Isilon OneFS cluster using the command line interface.
2. Issue the following commands:

   • To enable auditing:

     For OneFS 7.2 or earlier:

     di-isilon-1# isi audit settings modify--protocol-auditing-enabled on

     For OneFS 8.0 or later:

     di-isilon-1# isi audit settings global modify--protocol-auditing-enabled on

     Note:

     Veritas recommends that you enable the OneFS auditing feature only after you install and configure Data Insight for your storage environment. Otherwise, the backlog consumed by Data Insight may be so large that results may be stale for a prolonged time.

   • To adjust the audit log time

     Sometimes, auditing on the OneFS cluster may have been enabled before Data Insight is configured to monitor the cluster. In such cases, the cluster attempts to forward all events from the time auditing was configured. On OneFS, you can configure a setting to manually adjust time from which to begin forwarding the events to Data Insight.

     For example, use the following command to update the time to forward events newer than November 19, 2014 at 2:00 P.M.

     For OneFS 7.2 or earlier:

     isi audit settings modify --cee-log-time "protocol@2014-11-19 14:00:00"

     For OneFS 8.0 or later:

     isi audit settings global modify --cee-log-time "protocol@2014-11-19 14:00:00"

   • To disable auditing:

     For OneFS 7.2 or earlier:

     di-isilon-1# isi audit settings modify--protocol-auditing-enabled off

     For OneFS 8.0 or later:

     di-isilon-1# isi audit settings global modify--protocol-auditing-enabled off

   • To configure the audit settings:

     For OneFS 7.2 or earlier:

     di-isilon-1# isi audit settings modify

     --add-cee-server-uris=http://cee.example.com:12228/cee

     --audited-zones=system

     --hostname=di-isilon.example.com

     --config-auditing-enabled=no

     For OneFS 8.0 or later:

     di-isilon-1# isi audit settings global modify

     --add-cee-server-uris=http://cee.example.com:12228/cee

     --audited-zones=system --hostname=di-isilon.example.com

     --config-auditing-enabled=no

   • To view the audit settings:

     For OneFS 7.2 or earlier:

     di-isilon-1# isi audit settings view

     For OneFS 8.0 or later:

     di-isilon-1# isi audit settings global view

     Depending upon the configured audit settings, you may see the following response:

     Protocol Auditing Enabled: Yes
                 Audited Zones: System
               CEE Server URIs: http://cee.example.com:12228/cee	                        
                      Hostname: di-isilon.example.com
       Config Auditing Enabled: No
     

To configure Access Zones using the OneFS CLI

1. Log on to the Isilon OneFS cluster using the command line interface.
2. Issue the following command:

   isi zone zones modify <zone>

   --audit-success {close | create | delete | get_ security | logoff | logon | read | rename | set_security | tree_ connect | write | all} | --clear-audit-success

   --add-audit-success {close | create | delete | get_security | logoff | logon | read | rename | set_security | tree_ connect | write | all}

   --remove-audit-success <string>

   --audit-failure {close | create | delete | get_security | logoff | logon | read | rename | set_security | tree_ connect | write | all} | --clear-audit-failure

   --add-audit-failure {close | create | delete | get_security | logoff | logon | read | rename

To enable specific audit events using the OneFS CLI

1. Log on to the Isilon OneFS cluster using the command line interface.
2. Issue the following command:

   isi zone zones modify system --audit-success create,delete,rename,set_security

   Depending on your configuration, you may see the following response:

   di-isilon-1# isi zone zones list -v
                   Name: System
             Cache Size: 4.77M
          Map Untrusted:
             SMB Shares: -
         Auth Providers: -
         Local Provider: Yes
           NetBIOS Name:
         All SMB Shares: Yes
     All Auth Providers: Yes
     User Mapping Rules: -
   Home Directory Umask: 0077
     Skeleton Directory: /usr/share/skel
          Audit Success: create, delete, rename, set_security
          Audit Failure: -
                Zone ID: 1