6.3 HP StoreAll Storage File System User Guide (TA768-96093, June 2013)

Managing auditing
Auditing lets you:
• Find out which events you have already captured in the Express Query database and control
what gets captured in regards to file changes in the Express Query database. See “Audit log”
(page 222) for more information.
• Gather information from audit reports as to what is in the Express Query database. See “Audit
log reports” (page 223) for more information.
Audit log
The audit log provides a detailed history of activity for specific file system events. The Audit Log
panel shows the current audit configuration.
To change the configuration, click Modify on the Audit Log panel. On the Modify Audit Settings
dialog box, you can change the expiration policies and schedule, and you can change the events
that are audited. The default Audit Logs Expiration Policy is 45 days. If you need to keep audit
history for a longer period of time, increase the time period. Enable and disable event types and
groups using the checkboxes and the arrows to move events between the Disabled and Enabled
lists. If an event is not selected for auditing, it cannot be included in an audit report. By default,
all events are enabled. For significantly enhanced system performance and reduced audit log size,
if files are accessed frequently, disable the “File Read” event. Monitor the space used by the
<mount point>/.archiving/.database tree, which includes both current metadata and
audit log history. To reduce space usage, reduce the number of event types enabled for auditing
and/or shorten the Audit Logs Expiration Policy.
222 Express Query