<html><body><p>Hi John,<br>Nice paper! <br><br>Regarding object auditing:<br> - Does Varonis have an API that could be used to tell it when object operations complete from normal object interface? If so, a middleware module could be used to send interesting events to Varonis (this is already done in openstack auditing using CADF)<br> - With Varonis, can you monitor operations just on ".data" files? (these are the real objects) Can you also include file metadata values in the logging of these operations? If so, the object url could be pulled whenever a .data file is created, renamed (delete), or read<br><br>Thanks,<br>Bill Owen <br>billowen@us.ibm.com<br>Spectrum Scale Object Storage <br>520-799-4829<br><br><br><img width="16" height="16" src="cid:1__=8FBB0A17DFC67D678f9e8a93df938690918c8FB@" border="0" alt="Inactive hide details for John T Olson---12/09/2016 07:33:25 AM---Richard, I recently published a white paper in the Spectrum S"><font color="#424282">John T Olson---12/09/2016 07:33:25 AM---Richard, I recently published a white paper in the Spectrum Scale wiki in</font><br><br><font size="2" color="#5F5F5F">From: </font><font size="2">John T Olson/Tucson/IBM@IBMUS</font><br><font size="2" color="#5F5F5F">To: </font><font size="2">gpfsug main discussion list <gpfsug-discuss@spectrumscale.org></font><br><font size="2" color="#5F5F5F">Date: </font><font size="2">12/09/2016 07:33 AM</font><br><font size="2" color="#5F5F5F">Subject: </font><font size="2">Re: [gpfsug-discuss] Auditing of SMB file access</font><br><font size="2" color="#5F5F5F">Sent by: </font><font size="2">gpfsug-discuss-bounces@spectrumscale.org</font><br><hr width="100%" size="2" align="left" noshade style="color:#8091A5; "><br><br><br><font size="4">Richard,<br><br>I recently published a white paper in the Spectrum Scale wiki in developerworks about using Varonis with Spectrum Scale for auditing. This paper includes what type of file events are recognizable with the proposed setup. Here is link to the paper: </font><a href="https://www.ibm.com/developerworks/community/wikis/form/anonymous/api/wiki/fa32927c-e904-49cc-a4cc-870bcc8e307c/page/f0cc9b82-a133-41b4-83fe-3f560e95b35a/attachment/0ab62645-e0ab-4377-81e7-abd11879bb75/media/Spectrum_Scale_Varonis_Audit_Logging.pdf"><u><font size="4" color="#0000FF">https://www.ibm.com/developerworks/community/wikis/form/anonymous/api/wiki/fa32927c-e904-49cc-a4cc-870bcc8e307c/page/f0cc9b82-a133-41b4-83fe-3f560e95b35a/attachment/0ab62645-e0ab-4377-81e7-abd11879bb75/media/Spectrum_Scale_Varonis_Audit_Logging.pdf</font></u></a><font size="4"><br><br>Note that you have to register with developerworks, but it is a free registration.<br><br>Thanks,<br><br>John<br><br>John T. Olson, Ph.D., MI.C., K.EY.<br>Master Inventor, Software Defined Storage<br>957/9032-1 Tucson, AZ, 85744<br>(520) 799-5185, tie 321-5185 (FAX: 520-799-4237)<br>Email: jtolson@us.ibm.com<br>"Do or do not. There is no try." - Yoda<br><br>Olson's Razor:<br>Any situation that we, as humans, can encounter in life<br>can be modeled by either an episode of The Simpsons<br>or Seinfeld.<br><br></font><img src="cid:1__=8FBB0A17DFC67D678f9e8a93df938690918c8FB@" width="16" height="16" alt="Inactive hide details for Aaron Knister ---12/09/2016 06:21:40 AM---Hi Richard, Does this help?"><font size="4" color="#424282">Aaron Knister ---12/09/2016 06:21:40 AM---Hi Richard, Does this help?</font><font size="4"><br></font><font color="#5F5F5F"><br>From: </font>Aaron Knister <aaron.knister@gmail.com><font color="#5F5F5F"><br>To: </font>gpfsug main discussion list <gpfsug-discuss@spectrumscale.org><font color="#5F5F5F"><br>Date: </font>12/09/2016 06:21 AM<font color="#5F5F5F"><br>Subject: </font>Re: [gpfsug-discuss] Auditing of SMB file access<font color="#5F5F5F"><br>Sent by: </font>gpfsug-discuss-bounces@spectrumscale.org<font size="4"><br></font><hr width="100%" size="2" align="left" noshade><font size="4"><br><br></font><font size="5"><br>Hi Richard,</font><font size="4"><br></font><font size="5"><br>Does this help?</font><font size="4"><br></font><u><font size="4" color="#0000FF"><br></font></u><a href="https://moiristo.wordpress.com/2009/08/10/samba-logging-user-activity/amp/?client=safari"><u><font size="5" color="#0000FF">https://moiristo.wordpress.com/2009/08/10/samba-logging-user-activity/amp</font></u></a><font size="4"><br></font><font size="5"><br>I've not used CES so I don't know at what level it manages the samba configuration file or how easily these changes could be integrated in light of that. </font><font size="4"><br></font><font size="5"><br>Sent from my iPhone<br><br>On Dec 9, 2016, at 6:52 AM, Sobey, Richard A <</font><a href="mailto:r.sobey@imperial.ac.uk"><u><font size="5" color="#0000FF">r.sobey@imperial.ac.uk</font></u></a><font size="5">> wrote:</font><ul><ul><ul><ul><font size="4" face="Calibri">Hi all,</font><font size="4"><br></font><font size="4" face="Calibri"><br>Is there any auditing we can enable to track changes and accesses to files/folders on GPFS (via SMB/CES if that matters).</font><font size="4"><br></font><font size="4" face="Calibri"><br>Cheers<br>Richard</font><p><font size="5">_______________________________________________<br>gpfsug-discuss mailing list<br>gpfsug-discuss at </font><a href="http://spectrumscale.org/"><u><font size="5" color="#0563C1">spectrumscale.org</font></u></a><u><font size="4" color="#0000FF"><br></font></u><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss"><u><font size="5" color="#0563C1">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</font></u></a><tt><font size="4">_______________________________________________<br>gpfsug-discuss mailing list<br>gpfsug-discuss at spectrumscale.org</font></tt><tt><u><font size="4" color="#0000FF"><br></font></u></tt><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss"><tt><u><font size="4" color="#0000FF">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</font></u></tt></a></ul></ul></ul></ul><tt>_______________________________________________<br>gpfsug-discuss mailing list<br>gpfsug-discuss at spectrumscale.org<br></tt><tt><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a></tt><tt><br></tt><p><p><BR>
</body></html>