Monitoring file audit logging using mmhealth commands

You can use mmhealth commands to monitor the status of file audit logging.

The following mmhealth commands can be used to view the producer status on a per node or per cluster basis and file audit logging overall.

Use the following command to view the producer status on a per node basis:

# mmhealth node show FILEAUDITLOG

This command generates output similar to the following example:

Node name:      ibmnode1.ibm.com

Component     Status        Status Change     Reasons
-----------------------------------------------------------------------------------
FILEAUDITLOG  HEALTHY       4 days ago        -
device0       HEALTHY       4 days ago        -
device1       HEALTHY       4 days ago        -

There are no active error events for the component FILEAUDITLOG on this node (ibmnode1.ibm.com).

Use the following command to view more details about the producers on a per node basis:

# mmhealth node show FILEAUDITLOG -v

This command generates output similar to the following example:


Node name:      ibmnode1.ibm.com

Component       Status        Status Change             Reasons
------------------------------------------------------------------------------------------
FILEAUDITLOG    HEALTHY       2018-04-09 15:28:27       -
device0         HEALTHY       2018-04-09 15:28:56       -
device1         HEALTHY       2018-04-09 15:31:27       -

Event              Parameter  Severity   Active Since          Event Message
------------------------------------------------------------------------------------------------------------------------------

auditp_ok  device0    INFO       2018-04-09 15:28:27   Event producer for file system device0 is ok.
auditp_ok  device1    INFO       2018-04-09 15:31:26   Event producer for file system device1 is ok.

Use the following command to view the status for the entire cluster:

# mmhealth cluster show FILEAUDITLOG

This command generates output similar to the following example:


Component        Node                 Status            Reasons
------------------------------------------------------------------------------
FILEAUDITLOG     ibmnode1.ibm.com     HEALTHY           -
FILEAUDITLOG     ibmnode2.ibm.com     HEALTHY           -
FILEAUDITLOG     ibmnode3.ibm.com     HEALTHY           -
FILEAUDITLOG     ibmnode4.ibm.com     HEALTHY           -

Use the following command to view more details about each file system that has file audit logging enabled:

# mmhealth cluster show FILEAUDITLOG -v

This command generates output similar to the following example:


Component         Node                 Status            Reasons
-------------------------------------------------------------------------
FILEAUDITLOG      ibmnode1.ibm.com     HEALTHY           -
device0                                HEALTHY           -
device1                                HEALTHY           -
FILEAUDITLOG      ibmnode2.ibm.com     HEALTHY           -
device0                                HEALTHY           -
device1                                HEALTHY           -
FILEAUDITLOG      ibmnode3.ibm.com     HEALTHY           -
device0                                HEALTHY           -
device1                                HEALTHY           -
FILEAUDITLOG      ibmnode4.ibm.com     HEALTHY           -
device0                                HEALTHY           -
device1                                HEALTHY           -