Restituisci
-
Titolo
EMC events appear delayed when viewed in the Change Auditor Client -
Descrizione
The ChangeAuditor Coordinator is receiving new EMC events from a Change Auditor agent configured for EMC but the events appear to be delayed when viewed in Change Auditor Client. -
Causa
The EMC events sent by the EMC server to the ChangeAuditor agent are delayed by an internal EMC queue. This can be confirmed by performing the following:- Increase the ChangeAuditor agent logging to Debug to allow EMC events to be viewed in the Change Auditor agent log
- Below is an example of an EMC event in the ChangeAuditor Agent log:
ID: 4347Time: 12/12/14 15:50:18.216<Event event="0x1" path="\\emc.cifs\ifs\test\test.xls" flag="0x2" protocol="0" server="emc.cifs.domain.com" clientIP="192.168.1.2" serverIP="192.168.1.2" timeStamp="0x548B551900055B2E" userSid="S-1-5-21-2966119792-2635991036-4117835597-762845" desiredAccess="0x80" createDispo="0x1" ntStatus="0x0"/></EventList>- Copy the Timestamp: 0x548B551900055B2E
- Edit the Timestamp to: 548B5519 00055B2E
- Covert the first section of the Timestamp to DEC (http://www.binaryhexconverter.com/hex-to-decimal-converter): 548B5519 = 1418417433
- Convert the DEC value EPOCH to human readable (http://www.epochconverter.com/): 1418417433 = Fri, 12 Dec 2014 20:50:33 GMT
This is often caused by enabling auditing on the Isilon device for an extended period of time before the Change Auditor agent is actually up and running. The events/logs are kept in the audit folder on the device indefinitely, and when the EMC agent does come up to accept events, they are submitted by the device chronologically, oldest to newest.
-
Risoluzione
Engage the EMC Administrator or EMC Support to determine why there is a delay in the EMC server sending events to the Change Auditor Agent.
The old audit events need to be backed up and cleared out by disabling auditing in the EMC web GUI, going through the process of EMC Article 335488, then re-enabling auditing.
After this process is performed, new events should be submitted to the Change Auditor agent.