Audit logging

Audit logging tracks user actions that have the potential to negatively affect TS7700 operations if performed incorrectly or maliciously.

User actions that have the potential to negatively affect operations include such things as:
  • Log on and log out events
  • Configuration changes
  • Varying the machine on or off
  • User-initiated media export
  • Code updates
Audit logging events are captured by Simple Network Management Protocol (SNMP) traps that capture the following information that is associated with the event:
  • Identification of the machine affected, by IP address, including machine type, model, and serial number
  • User ID
  • Description of the event
  • Any applicable parameter data
These SNMP traps occur in real time (log events are sent as they occur). The logs are maintained on a remote server in a secure area.

Configuring SNMP on a TS7700

You can use the TS7700 Management Interface to configure and test SNMP traps on a TS7700 Cluster.
  1. Log in to the cluster on which you want to enable SNMP.
  2. Navigate to Settings>SNMP.
  3. Check the Enable SNMP Traps box.
  4. Enter a Trap Community Name.
  5. Click Submit Changes.
  6. On the Destination Settings table, select Add from the Select Actions drop-down menu.
  7. Enter a value for IP address. The machine with this IP address becomes the dedicated trap destination.
    Note: An SNMP monitoring application like The Tivoli® Security Information Event Manager must be installed on this machine to receive log events.
  8. Leave the value for Port unchanged.
  9. Click OK.
  10. Download an SNMP Management Information Block (MIB) file as described in Download an SNMP MIB file.
  11. Import the SNMP MIB file into your SNMP monitoring application on your trap destination machine.
  12. Test your SNMP trap configuration by clicking Send Test Trap on the SNMP page. If your configuration is correct, your SNMP monitoring application displays a successful capture of the test trap.

Download an SNMP MIB file

You can use any SNMP monitoring application to receive log events. The same application can also be used to filter the logged events, allowing for a single monitoring and filtering application for all clusters in the grid. The use of an SNMP MIB file permits you to replace a full text log description with a message identifier, preserving valuable storage space. The Tivoli Security Information Event Manager is an SNMP monitoring application that can be used to achieve these benefits.

Follow these instructions to locate and download a SNMP MIB file:
  1. Open the following link in your web browser: http://www-933.ibm.com/support/fixcentral/.
  2. Select System Storage from the Product selector menu.
  3. Select Tape Systems.
  4. Select Tape Virtualization.
  5. Select TS7700.
  6. Click Continue.
  7. On the Select Fixes page, check the box next to the SNMP MIB file you want.
  8. Click Continue.
  9. On the Download Options page, select Download using Download Director.
  10. Select the check box next to Include prerequisites and co-requisite fixes.
  11. Click Continue.
  12. On the Download files using Download Director page, ensure that the check box next to the SNMP MIB file version you want is checked and click Download now. The Download Director applet opens. The downloaded file is saved at C:\DownloadDirector\.