Chat now with support
Chat with Support

Change Auditor for Fluid File System 7.3 - Event Reference Guide

Introduction

Traditional approaches to handling file data growth have proven to be costly, hard to manage, and difficult to scale effectively and efficiently. Dell™ Fluid File System (FluidFS) is designed to go beyond the limitations of traditional file systems with a flexible architecture that enables organizations to scale out and scale up non-disruptively. It addresses organizational challenges by allowing you to gain control of data, reduce complexity, and meet growing data demands over time.

The FluidFS architecture is an open-standards based network attached storage (NAS) file system that supports industry standard protocols including NFS v4 and CIFS/SMB v2.1. It provides innovative features proving high availability, performance, efficient data management, data integrity, and data protection.

Specifically, the FluidFS technology:

•
Extends NAS capabilities across Dell’s primary storage arrays, Compellent and EqualLogic
•
Scales capacity and performance non-disruptively without forklift upgrades
•
Removes scalability limitations associated with traditional monolithic NAS architectures
•
Ensures efficiency by leveraging a shared infrastructure for block and file data
•
Supports business continuity through a resilient, purpose-built hardware architecture

Change Auditor for Fluid File System tracks, audits and alerts on file and folder changes in real time, translating events into simple text and eliminating the time and complexity required by system provided auditing. You can set the auditing scope on an individual file or folder or an entire file system recursive or non-recursive. You can also include or exclude certain files or folders from the audit scope in order to ensure a faster and more efficient audit process.

* 
NOTE: Change Auditor for Fluid File System audits only SMB operations on FluidFS clusters.

 

* 
NOTE: FluidFS auditing and event logging are only available if you have licensed Change Auditor for Fluid File System and have applied a FluidFS auditing template for each file system to be audited. Contact your Sales Representative for more information on obtaining Change Auditor for Fluid File System.

This guide lists the events that captured by Change Auditor for Fluid File System. Separate event reference guides are available that list the core Change Auditor events (when any Change Auditor license is applied) and the events captured when the different auditing modules are licensed.

Change Auditor for Fluid File System Events

This section lists the audited events captured by Change Auditor for Fluid File System.

 

* 
IMPORTANT: When expecting large numbers of events, it may be necessary to increase the Max Events per Connection setting in the client (Agent Configuration on the Administration Tasks tab) to avoid an ever-increasing backlog of events waiting to be sent from the agent to the coordinator database.
 
FluidFS Administration
* 
NOTE: To view a complete list of all the events, open the Audit Events page on the Administration Tasks tab in the client. This page contains a list of all the events available for auditing. It also displays the facility to which the event belongs, the severity assigned to each event, if the event is enabled or disabled, and the type of license that is required to capture each event.
 
Table 1. FluidFS Administration events
Event
Description
Severity

FluidFS Folder auditing changed

Created when changes are made to the folder auditing list on the file server.

Medium

FluidFS Folder created

Created when a folder is created on the file server.

Medium

FluidFS Folder deleted

Created when a folder is deleted form a file server.

Medium

FluidFS Folder moved

Created when a folder is moved on a file server.

Medium

FluidFS Folder renamed

Created when a folder is renamed on a file server.

Medium

FluidFS Folder ownership changed

Created when a folder’s ownership is changed on a file server.

Medium

FluidFS Folder access rights changed

Created when a folder’s access rights have changed on a file server.

Medium

FluidFS File auditing changed

Created when changes are made to the file auditing list on the file server.

Medium

FluidFS File created

Created when a file is created on the file server.

Medium

FluidFS File deleted

Created when a file is deleted form a file server.

Medium

FluidFS File moved

Created when a file is moved on a file server.

Medium

FluidFS File renamed

Created when a file is renamed on a file server.

Medium

FluidFS File opened

Created when a file is opened on a file server.

NOTE: After the first file open event, all subsequent opens by the same user do not generate events for 5 minutes. After 5 minutes, the accumulated open information is captured as one event.

Medium

FluidFS File ownership changed

Created when a file’s ownership is changed on a file server.

Medium

FluidFS File access rights changed

Created when a file’s access rights have changed on a file server.

Medium

FluidFS File contents written

Created when the contents are written on a file server.

NOTE: After the first file write event, all subsequent writes by the same user do not generate events for 5 minutes. After 5 minutes, the accumulated write information is captured as one event.

Medium

Log Events

When event logging for FluidFS is enabled on the Agent Configuration page of the Administration Tasks tab in Change Auditor, FluidFS audited events will also be written to a Windows event log, named ChangeAuditor for FluidFS event log. These log events can then be gathered by InTrust for further processing and reporting.

ChangeAuditor for FluidFS event log
* 
NOTE: To enable event logging, select Event Logging on the Agent Configuration page (Administration Tasks tab), and select the type of event logging to be enabled.

The following table lists the log events captured when FluidFS event logging is enabled. They are listed in numeric order by event ID.

 
Table 2. ChangeAuditor for FluidFS event log events
Event ID
Description

500

FluidFS Folder created

501

FluidFS Folder deleted

502

FluidFS Folder moved

503

FluidFS Folder renamed

504

FluidFS Folder ownership changed

505

FluidFS Folder access rights changed

506

FluidFS File created

507

FluidFS File deleted

508

FluidFS File moved

509

FluidFS File renamed

510

FluidFS File ownership changed

512

FluidFS File opened

514

FluidFS Folder auditing changed

515

FluidFS File auditing changed

Our brand, our vision. Together.

Our logo reflects our story: innovation, community and support. An important part of this story begins with the letter Q. It is a perfect circle, representing our commitment to technological precision and strength. The space in the Q itself symbolizes our need to add the missing piece — you — to the community, to the new Quest.

Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating