The audit log files contain records of the operations performed on the storage system, including the user who performed the operation, the date and time, and the storage system behaviors resulting from the operation. The audit log files are stored in the storage system controllers. To view the audit log files for the storage system, you must configure the storage system to transfer the log files to the syslog server and export the audit log files.
Use the following procedure to set up a syslog server for the audit logs for the storage system.
- You must have the Audit Log Administrator (View & Modify) role to perform this task.
- If you have a firewall between the storage system and the syslog server, the ports used to forward the syslog must be open.
- If you want to upload a certificate in PEM or DER format, you must first create a private key and a CSR (public key) in advance by selecting Audit Syslog Client (Primary), Audit Syslog Client (Secondary), or Audit Syslog Client (Primary and Secondary) for Purpose as described in Create a private key and a public key using the maintenance utility, and then prepare a signed certificate based on the CSR.
-
Click
Set Up Syslog Server.
Item Description Transfer Protocol Select the protocol for which you want to forward syslogs.
- TLS/RFC5424
- UDP/RFC3164
Primary Server Select whether to use a syslog server.
- Enable: Notify the Syslog server of an alert (SIM) via Syslog.
- Disable: Do not notify the Syslog server of alerts (SIMs) via Syslog.
Primary Server - Syslog Server Specify the hostname/IP address of the server you want to set as a syslog server. You cannot set an IP address with all zeros.
Identifier：Select to use a host name.
- Maximum length: 255 characters
- Allowed characters: alphanumeric characters (ASCII codes) and symbols: " \ ; : , * ? < > | / # & + = [ ] ' { } ^.
IPv4: Select to use an IPv4 address.
IPv6: Select to use an IPv6 address. You can also set an abbreviation for the IPv6 address.
Be sure to set it when you select Enable for Primary Server.
Primary Server - Port Number Specify the port number to be used by the syslog server. Be sure to set it when you select Enable for Primary Server.
Primary Server - Client Certificate File Name Configure the certificate file. Click Choose File and set the certificate file.
This is always set when TLS/RFC5424 is selected in Transfer Protocol and Enable is selected in Primary Server.
If you apply the settings and then apply the settings again, the last updated certificate will be used if the certificate is not configured (blank).
Primary Server - Password Set the password for the client certificate. You can set a password of up to 128 characters.
Allowed characters: alphanumeric characters (ASCII codes) and symbols: ! # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~.
Primary Server - Root Certificate File Name Configure the certificate file. Click Choose File and set the certificate file.
Syslog protocol TLS/RFC5424 is selected for Transport protocol and Enable is selected for primary server.
If you apply the settings and then apply the settings again, the last updated certificate will be used if the certificate is not configured (blank).
Secondary Server Select whether to use an alternate server for the syslog server.
Enable: Notify an alert (SIM) to an alternate server of the syslog server by Syslog.
Disable: Do not notify an alert (SIM) to an alternate server of the syslog server via Syslog.
Secondary Server - Syslog Server Set the hostname/IP address of the server you want to set as an alternate server for the syslog server. You cannot set an IP address with all zeros.
Identifier：Select to use a host name.
- Maximum length: 255 characters
- Allowed characters: alphanumeric characters (ASCII codes) and symbols: " \ ; : , * ? < > | / # & + = [ ] ' { } ^.
IPv4: Select to use an IPv4 address.
IPv6: Select to use an IPv6 address. You can also set an abbreviation for the IPv6 address.
Be sure to set it when you select Enable for Secondary Server.
Secondary Server - Port Number Specify the port number to be used by the syslog server. Be sure to set it when you select Enable for Secondary Server.
Secondary Server - Client Certificate File Name Configure the certificate file. Click Choose File and set the certificate file.
This is always set when TLS/RFC5424 is selected in Transfer Protocol and Enable is selected in Secondary Server.
If you apply the settings and then apply the settings again, the last updated certificate will be used if the certificate is not configured (blank).
Secondary Server - Password Set the password for the client certificate. You can set a password of up to 128 characters.
Allowed characters: alphanumeric characters (ASCII codes) and symbols: ! # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~.
Secondary Server - Root Certificate File Name Configure the certificate file. Click Choose File and set the certificate file.
Syslog protocol TLS/RFC5424 is selected for Transport protocol and Enable is selected for secondary server.
If you apply the settings and then apply the settings again, the last updated certificate will be used if the certificate is not configured (blank).
Location Identification Name Set an arbitrary name to identify the storage system that forwards alerts (SIMs) to the syslog server. You can set a name of up to 32 characters.
Allowed characters: alphanumeric characters (ASCII codes) and symbols: ! # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~.
Be sure to set it when Primary Server or Secondary Server is Enable.
Retry The retry settings are displayed.
- Enable: Retry if communication with the syslog server fails.
- Disable: Do not retry if communication with the syslog server fails.
This can be set only when TLS/RFC5424 is selected in Transfer Protocol.
Retry Interval Set the retry interval between 1 to 60 seconds when communication with the syslog server fails.
Be sure to set it when you select Enable in Retry.
Output Detailed Information - Enable: Send the detailed information of the audit log.
- Disable: Do not send the detailed information of the audit log.