Chat now with support
Chat with Support

Change Auditor for NetApp 7.3 - User Guide

Create custom NetApp searches

The following scenarios explain how to use the What tab to create custom NetApp searches.

To search for all file system events including NetApp events:
* 
NOTE: If you wanted to, you can use the other search properties tabs to define additional criteria:
•
Who - allows you to search for events generated by a specific user, computer or group
•
Where - allows you to search for events captured by a specific agent or within a specific domain or site
•
When - allows you to search for events that occurred within a specific date/time range
•
Origin - allows you to search for events that originated from a specific workstation or server
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all users.
3
Click New at the top of the Searches page.
This will activate the Search Properties tabs across the bottom of the Searches page.
4
On the Info tab, enter a name and description for the search.
5
Open the What tab, expand Add and select Subsystem | File System.
6
On the Add File System Path dialog, select the All File System Paths option.
7
Review the Actions section and select those that are to be included in the search.
By default, All Actions is selected meaning that all of the actions associated with the file system path will be included in the search.
8
Click OK to save your selection and close the dialog.
9
Once you have defined your search criteria, click Run to save and run the search.
10
When this search runs, Change Auditor searches for all file system events including NetApp events and display the results in a new search results page.
To search for events performed against a specific NetApp file or folder:
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.
3
Click New to enable the Search Properties tabs across the bottom of the Searches page.
4
On the Info tab, enter a name and description for the search.
5
Open the What tab, expand Add and select Subsystem | File System.
6
On the Add File System Path dialog, select one of the following scope options:
•
This Object - select to search only the selected object.
•
This Object and Child Objects Only - select to search the selected object and its direct child objects.
•
This Object and All Child Objects - select to include the selected object and all subordinate objects (in all levels)
7
In the Path field, enter or use the browse button to select the NetApp filer path to be searched.
•
To search for events against a specific volume, enter the path as follows: \\<FilerName>\<ShareName>\
•
To search for events against a specific folder, enter the path as follows: \\<FilerName>\<ShareName>\<FolderName>\
•
To search for events against a specific file, enter the path as follows: \\<FilerName>\<ShareName>\<FolderName>\<FileName.ext>
* 
NOTE: If the scope of your search is This Object, you can use the * wildcard character to specify the NetApp filer path. That is, use an asterisk (*) to substitute zero or more characters.

When using the This Object option, be sure to select the appropriate Type option to define the type of path to be searched: Files or Folders.

8
Review the Actions section and select those that are to be included in the search.
By default, All Actions is selected meaning that all of the actions associated with the path will be included in the search.
When the scope includes child objects, All Types are selected by default meaning that all types of paths will be searched. If you selected the This Object scope option, Files is selected by default, which can be changed to Folders. Only one type can be selected.
* 
NOTE: The Transaction option does not apply to NetApp events.
9
Click OK to save your selection and close the dialog.
10
Click Run to save and run the search. Click Save to save the search definition without running it.
11
When this search runs, Change Auditor searches for NetApp events in the selected path and display the results in a new search results page.
To search for a specific NetApp event class:
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all Change Auditor users.
3
Click New to enable the Search Properties tabs across the bottom of the Searches page.
4
On the Info tab, enter a name and description for the search.
5
Open the What tab, click Add (or expand Add and select Event Class).
6
On the Add Facilities or Event Classes dialog, enter NetApp in the data filter field under the Facility heading to display all of the NetApp events.
7
From this list, select one or more events and use the Add | Add This Event option to add the selected events to the list box at the bottom of the dialog. Click OK to save your selection and close the dialog.
8
Click Run to save and run the search. Click Save to save the search definition without running it.
9
When this search runs, Change Auditor searches for the NetApp events based on the search criteria specified on the What tab and display the results in a new search results page.

 

Performance Considerations

This section contains strategies to help minimize performance issues.

* 
NOTE: Quest recommends for all environments, a phased approach to setting up file/folder auditing for NetApp devices. A phased approach will allow file/folder auditing to be deployed in stages so that performance is not impacted.
•
Change Auditor agent performance
•
Configuring audit scope

Change Auditor agent performance

Performance is directly linked to the CPU speed and network latency of the server hosting the agent collecting the NetApp events.

•
Hardware considerations
•
Load balancing
Hardware considerations

To improve agent performance, you can:

•
Upgrade the link between the NetApp filer and the agent to decrease network latency.
•
Add extra CPUs to the current agent or select a more powerful agent host with more CPUs or CPU cores available.

See the Release Notes for required rights and permission.

Load balancing

You may improve performance by assigning a NetApp auditing template to more than one agent. When multiple agents are assigned to the same template, events are load-balanced between these agents. However, the downside is that the ‘where’ field for NetApp events may contain any one of the agents being monitored by this single auditing template. In addition, if NetApp event logging is enabled in Change Auditor, events will be written on multiple agent servers.

.
* 
NOTE: Only increase the number of agents if a single agent cannot handle the volume of events generated.
* 
NOTE: For NetApp filers generating a large amount of events, it is recommended that you do NOT assign the same agents to multiple filers (NetApp Auditing templates).
* 
NOTE: An ONTAP 7.2 filer can be audited by one or more agents for load balancing of events, but the same agents cannot audit more than one ONTAP 7.2 filer.

Configuring audit scope

Audit only volumes, extensions and operations that are vital for your environment. Use the NetApp auditing template to specify the auditing scope for a NetApp filer. For example, using the NetApp Auditing template you can:

•
Decrease the number of volumes being audited
•
Set the Audit Path to File, Folder or Volume and enter the file, folder or volume to be audited.
•
To specify a file, enter: <ShareName>\<Path>\<FileName>
•
To specify a folder, enter: <ShareName>\<FolderName>
•
To specify a volume, enter: <VolumeName>
* 
NOTE: Specifying a volume name provides the best performance.
•
Decrease the number of file extensions being audited
•
Use the Inclusions tab to specify individual subfolders or files to be included for auditing.
* 
NOTE: For better performance, on the Inclusions tab specify only three characters for included extensions (e.g., *.txt, *.x??).
•
Use the Exclusions tab to exclude individual subfolders or files from auditing.
* 
NOTE: On both the Inclusions and Exclusions tabs, you can specify a group of files or subfolders using wildcard characters. That is, use an asterisk (*) to substitute zero or more characters or use a question mark (?) to substitute a single character.

See File and Folder Inclusion and Exclusion Examples for more information and examples.

•
Decrease the number of operations being audited
•
Use the Events tab to select only vital file and/or folder events.

 

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating