Loading...
Loading...
If you are using CEE, in newer 9+ versions of OneFS, you can manually purge Audit entries with this command: isi audit logs delete --before 2022-11-12 The cluster attempts to purge any entries on or prior to the listed date. This removes the materials from the relevant directories, such as /ifs/.ifsvar/audit/logs/node001/protocol . This will not edit the individual files, to extract specific entries. It culls the "older" files wholesale. This is the expected behavior. Note: This action, if performed successfully, is utterly irrevocable. Support and Engineering will be unable to recover such purged content. It is permanently gone. Note: This functionality requires CEE environments and for messages to have been sent and processed to CEE. If you are only using syslog forwarding or local storage with no forwarding, contact Support for options. However, if any of the entries there are "not processed", and you check the status of the purge, you see a result like this: Run the purge: Alpha-1# isi audit logs delete --before 2022-11-12 -f The purging request has been triggered. `isi audit logs check` can be used to monitor the process. Review the results: Alpha-1# isi audit logs check Purging Status: Using Before Value: 2022-11-12 Currently Manual Purging Status: COMPLETED Some unforwarded audit logs will not be purged: LNN Topic Consumer Date ----------------------------------------------------------- 1 protocol Protocol CEE Forwarder 2022-11-05 23:29:08 2 protocol Protocol CEE Forwarder 2022-11-06 02:59:25 3 protocol Protocol CEE Forwarder 2022-11-06 02:52:48 The respective material can be purged after it has caught up. There are for design reasons no real ways around this, to try to preserve the continuity and integrity of these audit records. There is a single additional option, for which you must directly contact Isilon support and raise a ticket around KB article 167091: Powerscale: How to Remove Audit Log Files The process and steps in that KB are limited to Isilon support. In short, it would get rid of your entire current audit-related datafile structure, as essentially a "clean restart" . This would leave the legacy material saved under your /ifs directory. You, as the customer could then delete that material or store it elsewhere for backup reasons as you prefer.
This is due to intentional design limitations to increase the survivability and safety of unprocessed audit material.
Wait for unprocessed material to be processed or contact support to arrange for the entire relevant structure to be reset.
Click on a version to see all relevant bugs
Dell Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.