Return
-
Title
Isilon auditing falls behind over time if security events cannot be resolved due to unavailable IFS share -
Description
Isilon auditing falls behind if security events cannot be resolved due to unavailable IFS admin share. There may be many error in the Change Auditor agent log similar to:
2017-08-30 19:22:02.784 [532][ERROR][Emc::EmcSink::WorkerMain(287)] Error processing EMC event (Emc::FileX::GetFileSecurityX - Unable to retrieve security descriptor from path: \\isilon\ifs\data\file1.txt Error: The network name cannot be found.).If debug mode is enabled on the Change Auditor agent the associated security scan requests for such errors will have arrived for processing at the agent roughly 1 minutes prior to the corresponding error:2017-08-30 19:20:58.145[532][DEBUG][Emc::EmcSink::ProcessObjectPermissionChange(565)] Retrieving file security for \\isilon\ifs\data\file1.txt -
Cause
When the network path cannot be resolved on Window 2012 or higher the SMB timeout may take roughly 1 minute to occur. During this time, incoming scan requests will be queued on agent-side for processing. Until the timeout has occurred on the attempt to resolve the ACL on the security change event pending requests will wait. This behavior may occur if IFS share has been deleted or renamed and not specified accordingly in the Change Auditor template. -
Resolution
1. Confirm the IFS share exists, the path is expected and can be browsed to from the agent server successfully.
2. Ensure the IFS share (if not the default name) is specified accordingly in the Change Auditor template