Help on Cluster Management > Auditing > Settings

The following controls and information are available at Cluster Management > Auditing > Settings.

Note Image

It is recommended that you install and configure third-party auditing applications before you enable the OneFS auditing feature. Otherwise, the backlog of audited events consumed by the tool may be so large that results may be stale for a prolonged time.

Enable Configuration Change Auditing
Enables auditing requests that are made through the API for system configuration changes. When you enable or disable system configuration auditing, no additional configuration is required. PAPI is monitored.
Enable Protocol Access Auditing
Enables auditing requests that are made through the SMB and NFS protocol to access data. If you enable protocol auditing for an access zone, file-access events through the SMB and NFS protocol are recorded in the protocol audit topic directories.
Add zones
Opens a dialog box that enables you to select a zone in your cluster to be audited.
Zone name
Table that displays all access zones currently in the system. Select the access zones that you want to be audited.
Cancel
Closes the dialog box without saving the edit.
Add zone
Adds selected zones to be audited.
Audited zones
Table that displays the access zones selected for auditing.
Zone
Displays names of access zones to be audited.
Actions
Lists available actions for selected access zones.
Remove
Removes the selected access zone from the list of zones to be audited.
CEE Server URIs
Text field for entry of location for event forwarding using the Common Event Enabler (CEE). CEE URI must start with http:// and include port and path to CEE server if necessary.
Add another input field
Opens additional field to add additional CEE URIs.
Storage Cluster Name
Specifies storage cluster name. This field is required only if needed by your third-party audit application.
Revert Changes
Reverts page to previous saved state.
Save Changes
Saves current changes to page. Until this is selected, none of the edited actions are live on the cluster.