<div dir="ltr"><div><div>Hi Eric<br><br></div>The company I work for could possibly help with this, <a href="https://www.ellexus.com/" target="_blank">Ellexus</a>. Please feel free to get in touch if you need some help with this.<br></div><div><br></div><div>Cheers<br></div>Richard<div class="gmail_extra"><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div><div><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
------------------------------<wbr>------------------------------<wbr>----------<br>
<br>
Message: 1<br>
Date: Thu, 19 Oct 2017 21:15:38 -0500<br>
From: Eric Ross <<a href="mailto:er.a.ross@gmail.com" target="_blank">er.a.ross@gmail.com</a>><br>
To: <a href="mailto:gpfsug-discuss@spectrumscale.org" target="_blank">gpfsug-discuss@spectrumscale.o<wbr>rg</a><br>
Subject: [gpfsug-discuss] file auditing capabilities<br>
Message-ID:<br>
        <<a href="mailto:CALS6xOom16NOhOfVH%2B8ymJKO-QYzeZdMxA2-kw_EjSWHauvZXA@mail.gmail.com" target="_blank">CALS6xOom16NOhOfVH+8ymJKO-QYz<wbr>eZdMxA2-kw_EjSWHauvZXA@mail.gm<wbr>ail.com</a>><br>
Content-Type: text/plain; charset="UTF-8"<br>
<br>
I'm researching the file auditing capabilities possible with GPFS; I<br>
found this paper on the GPFS wiki:<br>
<br>
<a href="https://www.ibm.com/developerworks/community/wikis/form/anonymous/api/wiki/fa32927c-e904-49cc-a4cc-870bcc8e307c/page/f0cc9b82-a133-41b4-83fe-3f560e95b35a/attachment/0ab62645-e0ab-4377-81e7-abd11879bb75/media/Spectrum_Scale_Varonis_Audit_Logging.pdf" rel="noreferrer" target="_blank">https://www.ibm.com/developerw<wbr>orks/community/wikis/form/anon<wbr>ymous/api/wiki/fa32927c-e904-<wbr>49cc-a4cc-870bcc8e307c/page/<wbr>f0cc9b82-a133-41b4-83fe-3f560e<wbr>95b35a/attachment/0ab62645-<wbr>e0ab-4377-81e7-abd11879bb75/<wbr>media/Spectrum_Scale_Varonis_<wbr>Audit_Logging.pdf</a><br>
<br>
I haven't found anything else on the subject, however.<br>
<br>
While I like the idea of being able to do this logging on the protocol<br>
node level, I'm also interested in the possibility of auditing files<br>
from native GPFS mounts.<br>
<br>
Additional digging uncovered references to Lightweight Events (LWE):<br>
<br>
<a href="http://files.gpfsug.org/presentations/2016/SC16/04_Scott_Fadden_Spectrum_Scale_Update.pdf" rel="noreferrer" target="_blank">http://files.gpfsug.org/presen<wbr>tations/2016/SC16/04_Scott_Fad<wbr>den_Spectrum_Scale_Update.pdf</a><br>
<br>
Specifically, this references being able to use the policy engine to<br>
detect things like file opens, reads, and writes.<br>
<br>
Searching through the official GPFS documentation, I see references to<br>
these events in the transparent cloud tiering section:<br>
<br>
<a href="https://www.ibm.com/support/knowledgecenter/en/STXKQY_4.2.2/com.ibm.spectrum.scale.v4r22.doc/bl1adm_define_cloud_storage_tier.htm" rel="noreferrer" target="_blank">https://www.ibm.com/support/kn<wbr>owledgecenter/en/STXKQY_4.2.2/<wbr>com.ibm.spectrum.scale.v4r22.d<wbr>oc/bl1adm_define_cloud_storage<wbr>_tier.htm</a><br>
<br>
but, I don't see, or possibly have missed, the other section(s)<br>
defining what other EVENT parameters I can use.<br>
<br>
I'm curious to know more about these events, could anyone point me in<br>
the right direction?<br>
<br>
I'm wondering if I could use them to perform rudimentary auditing of<br>
the file system (e.g. a default policy in place to log a message of<br>
say user foo either wrote to and/or read from file bar).<br>
<br>
Thanks,<br>
-Eric<br>
<br>
<br>
------------------------------<br>
<br>
______________________________<wbr>_________________<br>
gpfsug-discuss mailing list<br>
gpfsug-discuss at <a href="http://spectrumscale.org" rel="noreferrer" target="_blank">spectrumscale.org</a><br>
<a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss" rel="noreferrer" target="_blank">http://gpfsug.org/mailman/list<wbr>info/gpfsug-discuss</a><br>
<br>
<br>
End of gpfsug-discuss Digest, Vol 69, Issue 38<br>
******************************<wbr>****************<br>
</blockquote></div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><font color="#888888"><span><font color="#888888"><span><font color="#888888"><span><br></span></font></span></font></span></font><span></span></div></div></div></div></div>
</div></div></div></div></div>
</blockquote></div><br>
</div></div>