6.5 HP StoreAll OS CLI Reference Guide

ibrix_audit_reports
Generates audit reports.
Description
The ibrix_audit_reports command generates reports for events stored in an Express Query
database’s audit log tables for a given file system. You can select the types of events you want to
include in the report, and you can specify a start and end date for the report.
NOTE: Although you can start several audit report tasks at the same time, the tasks are queued.
Only one task can be in the RUNNING state at a time.
Synopsis
Generate an audit report:
ibrix_audit_reports -t SORT_ORDER -f FILESYSTEM [-p PATH] [-b BEGIN_DATE]
[-e END_DATE] [-o class1[,class2,...]]
Generates an audit report in CSV (comma-separated) format with a header row. Audit reports are
placed in the following file:
<file_system_mountpoint>/.archiving/reports/<TASK_ID>, where TASK_ID is
displayed when you generate the audit report.
The -t option specifies the sort order of the report, where SORT_ORDER is one of the following:
• time — lists all events ordered by timestamp
• path — lists all file events ordered by pathname
• unordered — lists events in no particular order
The -o option specifies the classes of events to be included in the report. (See “Audit events,” later
in this section, for the supported events.) Enter all to include all events.
The following example provides a chronological event history of the ibrixfs1 file system. The
event list includes all events from 01/17/2011 (because no time is supplied, the report starts at
00:00:00) to 01/17/2011 at 10:30.
ibrix_audit_reports -t time -f ibrixfs1 -o all -b "01/17/2011" -e
"01/17/2011 10:30"
The next example provides a chronological event history of the file /logs/secret.txt in the
ibrixfs1 file system. The event list includes only the file_created and report_ended
events.
ibrix_audit_reports -t path -f ibrixfs1 -p /logs/secret.txt -o
file_created,report_ended
Set the expiration policy for audit reports on a file system:
ibrix_audit_reports -s POLICY -f FILESYSTEM
The POLICY is one of the following:
• 45d -- By default, audit reports are kept for 45 days.
• xxD — audit reports are kept for the specified number of days (for example, 90D specifies
that reports should be kept for 90 days)
• xxM — audit reports are kept for the specified number of months
• xxY — audit reports are kept for the specified number of years
14 StoreAll commands