Move the log position of the CEE forwarder

You can manually move the log position of the CEE forwarder if the event time in the audit log indicates a lag in comparison to the current time. This action globally moves the event time in all of the logs of the CEE forwarder within an Isilon cluster to the closest time.

About this task

Note Image

The events that are skipped will not be forwarded to the CEE server even though they might still be available on the cluster.

Procedure

  • Run the isi audit settings global modify command with the --cee-log-time option to move the log position of the CEE forwarder.
    The following command moves the log position of the CEE forwarder manually: 
    isi audit settings global modify --cee-log-time='protocol@2016-01-27 01:03:02'