立即与支持人员聊天
与支持团队交流

Change Auditor for EMC 7.4 - User Guide

EMC Isilon Auditing

EMC Isilon file server auditing is supported; however, automatic Isilon auditing configuration is not supported. This section discusses the manual configuration required to capture events from an Isilon file server.

Configuration Notes
•
On the agent intended to audit the Isilon server, install CEE. You may need to configure the firewall setting on your server before the CEE application can receive events from an Isilon server.
•
Change Auditor does not support automatic Isilon auditing configuration. To enable Isilon file server auditing, use the Isilon management web site UI and command line interface.
See EMC OneFS Web Administration Guide (http://bit.ly/onefs-web-administration-guide-7-1) and EMC OneFS CLI Administration Guide (http://bit.ly/onefs-cli-administration-guide-7-1) for more information.
* 
NOTE: An EMC account is required to access these EMC administration guides.
•
When asked for the URI for the CEE server, use the following format:
‘http://<FQDN of CA agent/CEE server>:12228/vee’
•
To configure Change Auditor for EMC to audit an Isilon server, use the EMC Auditing wizard. Isilon servers are not listed in the EMC File Server (CIFS) drop-down, but can be manually entered:
Make sure that the server name specified is the one configured in the Isilon auditing setting:
•
‘Volume’ auditing is not supported on Isilon servers and should not be used.
•
When specifying file and folder paths to be audited, the Isilon’s shared directory path should be used. You can find it in Isilon management web site UI by going to Protocols – Windows Sharing (SMB) – SMB Shares.
For example: To audit \\IsilonName\Storage\TestFolder folder, you need to specify ifs\data\TestFolder in the Audit Path field of the template in Change Auditor. Ensure that the backslash (\) is used in the path in Change Auditor template.
•
Owner and permission events are supported, but events captured contain only ‘to’ values and no ‘from’ values. To capture permission changes on Isilon, the Change Auditor agent account (typically the Local System account which translates to the agent computer account) should have Read permissions on the IFS share (or its equivalent). This can be accomplished by adding a computer account to a group and granting Read access to the group.
Individual computer accounts can also be added using ISI command line on the Isilon itself.
For example: isi smb shares permission create ifs --sid COMPUTER_ACCOUNT_SID --permission-type allow --permission read
In addition, agent computer accounts require Read access to all the files\folders to be audited (via Windows security). In the case where users have modified the default inherited security on their folders/files, Change Auditor will be unable to query those items.There is no need to enter information on the Logon Credentials dialog when configuring auditing on an Isilon server.
•
To audit the "File contents written" operations, you must audit "Close" operations on Isilon. To audit close operations, use isi zone zones modify command in the command line interface (CLI).

For example:
•
To audit a successful close operation for the 'System' zone run the following command:
isi zone zones modify system --add-audit-success close.
•
To review all currently audited operations for the System zone, use the following command:
isi zone zones view system

EMC Unity Auditing

EMC Unity NAS server auditing is supported; however, automatic unity auditing configuration is not. This section discusses the manual configuration required to capture events from a Unity NAS server.

Configuration Notes
•
On the agent intended to audit the Unity NAS server, install CEE. You may need to configure the firewall setting on your server before the CEE application can receive events from a Unity server.
•
Change Auditor does not support automatic Unity auditing configuration. See the EMC Unity documentation for configuring host for more information.
To enable auditing, you must configure CEE using EMC Unisphere:
•
Select STORAGE | File | NAS Servers. Open the server properties and select Event Publishing. Select to Enabling Common Event Publishing. Add the CEPA Server where the CEE is installed, select All Events, and save the settings.
•
Select File System you want to audit and choose the Advanced tab. Under the Events Notifications, select Enable SMB Events publishing.
•
When you create the EMC auditing template to audit a Unity NAS server, you need to enter the NAS servers as they are not listed in the EMC File Server (CIFS) drop-down option. Ensure that you specify the server configured in the Unity auditing setting. For details on creating a template, see EMC auditing templates.
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级