ChangeAuditor simply registers as a scan engine to process the audit data as it is sent to the agent for processing
It does not perform any ‘extra’ administrative duties on the filer (such as the clearing of logs). There should be some mechanism/task on the filer-side to clear or control its own log data.
A similar situation with Isilon devices has been noted, where auditing was enabled pre-emptively and filled up the ifs/.ifsvar/audit folder on the device with many old (and undesired) events that were not specified for auditing.
The old audit events needed to be backed up and cleared out by disabling auditing in the EMC web GUI, going through the process of EMC Article 335488 (contact EMC for this article), then re-enabling auditing. This may or may not be the practice for VNX devices.
© 2024 Quest Software Inc. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center