[gpfsug-discuss] Re Auditing

[Oesterlin, Robert]

We run a policy that looks like this:

-- cut here --
      define(daysToEpoch, days(timestamp('1970-01-01 00:00:00.0')))
      define(unixTS,
               char(int(
                 (( days(\$1) - daysToEpoch ) * 86400) +
                 (  hour(\$1) * 3600) +
                 (minute(\$1) * 60) +
                 (second(\$1))
               ))
            )

      rule 'dumpall' list '"$filesystem"' DIRECTORIES_PLUS
      SHOW(                                      '|' ||
            varchar(user_id)                  || '|' ||
            varchar(group_id)                 || '|' ||
            char(mode)                        || '|' ||
            varchar(file_size)                || '|' ||
            varchar(kb_allocated)             || '|' ||
            varchar(nlink)                    || '|' ||
            unixTS(access_time,19)            || '|' ||
            unixTS(modification_time)         || '|' ||
            unixTS(creation_time)             || '|' ||
            char(misc_attributes,1)           || '|'
          )
-- cut here --


Bob Oesterlin
Sr Principal Storage Engineer, Nuance




From: <gpfsug-discuss-bounces at spectrumscale.org> on behalf of Mark Bush <Mark.Bush at siriuscom.com>
Reply-To: gpfsug main discussion list <gpfsug-discuss at spectrumscale.org>
Date: Monday, July 31, 2017 at 12:31 PM
To: "gpfsug-discuss at spectrumscale.org" <gpfsug-discuss at spectrumscale.org>
Subject: [EXTERNAL] [gpfsug-discuss] Auditing

Does someone already have a policy that can extract typical file audit items (user_id, last written, opened/accessed, modified, deleted, etc)?  Am I barking up the wrong tree for this is there a better way to get this type of data from a Spectrum Scale filesystem?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://gpfsug.org/pipermail/gpfsug-discuss_gpfsug.org/attachments/20170731/ab78e078/attachment-0001.htm>