Arctera Insight Information Governance Administrator's Guide

To purge the audit logs from an Isilon filer

1. Log on to the Isilon cluster CLI using SSH or Telnet as a root user.
2. Stop the isi_audit_d and isi_audit_cee processes from automatically restarting, by executing the commands:

   isi services -a isi_audit_d ignore

   isi services -a isi_audit_cee ignore

3. Terminate the isi_audit_d and isi_audit_cee processes, by executing the commands:

   isi_for_array 'pkill isi_audit_d'

   isi_for_array 'pkill isi_audit_cee'

4. Verify that no isi_audit processes are running on the cluster, by executing the command:

   isi_for_array -s 'pgrep -l isi_audit'

5. Change directory to the audit directory, by executing the command:

   cd /ifs/.ifsvar/audit

6. To ensure that you are in the /ifs/.ifsvar/audit directory, execute the command:

   pwd

7. Optionally, create a backup of your audit directory if you want to preserve your old audit logs. You can move or copy them to another directory by using either mv or cp command.
8. Delete the audit directory by executing the command:

   rm -rf /ifs/.ifsvar/audit

9. Inform the Master Control Program (MCP) to resume monitoring the audit daemons, by executing the following commands:

   isi services -a isi_audit_d monitor

   isi services -a isi_audit_cee monitor

   MCP automatically restarts the audit daemons and reconstructs the audit directory on each node when the isi_audit_d process is running.

10. Check if the audit processes have restarted, by executing the command:

    isi_for_array -s 'pgrep -l isi_audit'

11. Verify that audit data was removed and reconstructed, by executing the command:

    isi_audit_viewer -t protocol

12. Verify that the audit log files are being populated after audit processes have restarted, by executing the command:

    isi_audit_viewer -t protocol