On EMC (NetApp has the same issue), when auditing File opens, up to four events (scan requests) from the filer is collected.
So, with 1 Agent, only 1 file open events should be collected as Change Auditor run consolidation rule against all incoming events (10 seconds is the default). So when only 1 Agent is used in the Template, the issue should be masked - The 3 duplicates are suppressed.
However, with 2 Agents, the EMC filer will round-robin the events so the Agents will get 2 events each. Since consolidation occurs at the Agent level, 2 events should be added in the database for the same change.
The only way to get rid of this limitation is if EMC/NetApp modify their audit subsystem and only produce 1 event (scan request) for the change itself and not send as many duplicates.
Customers should log an enhancement request with EMC or NetApp so they update their code to reduce the number of 'File Open' scan request generated.
That would be the proper way to solve the issue since CA Agent is simply processing the events (scan requests) sent from the filer.
© 2024 Quest Software Inc. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center