Monitoring file audit logging

The following topics describe various ways to monitor file audit logging in IBM Storage Scale.

Monitoring file audit logging states
File audit logging is integrated into the system health infrastructure. Alerts are generated for producers that write audit events and create the audit logs.
Monitoring the file audit logging fileset for events
To verify that a node is getting events in the file audit logging fileset after file audit logging is enabled, use the tail command and write IO to the audited device.
Monitoring file audit logging using mmhealth commands
You can use mmhealth commands to monitor the status of file audit logging.
Monitoring file audit logging using the GUI
You can use the GUI to monitor file audit logging.
Monitoring file audit logging using audit log parser
The audit_parser script is located in /usr/lpp/mmfs/samples/util, which can be used to query the events in the file system's .audit_log directory.
Example of parsing file audit logs with python
You can use a program to parse the JSON of file audit logging to get information about specific attributes.
Monitoring file audit logging with rsyslog and SELinux
Files and directories within the file audit logging fileset can inherit Security-Enhanced Linux® (SELinux) security contexts from their parent directories.

Parent topic: Monitoring