6.5 HP StoreAll OS User Guide

Table 31 Fields on the Modify Auditing Settings dialog box (continued)
DescriptionField
Set the expiration period for the audit logs (the number of
days audit logs are kept).
Audit Logs Expiration Policy
Identifies the events that are either disabled or enabled.
When auditing in first enabled, all events are disabled by
default. You can manage events as follows:
Disabled Events and Enabled Events
• Click the double right arrow to move all events from the
Disabled Events box to the Enabled Events box.
• Click the double left arrow to move all events from the
Enabled Events box to the Disabled Events box.
• Select an individual event in either box and click the
appropriate single arrow (left or right) to either enable
or disable it.
• Select a category of events to move all of the events in
that category to the Enabled Events box. See Table 32
(page 301) for the list of events by category.
NOTE: In StoreAll OS 6.5 or later, the Never Expire option (referred to as forever in the
CLI) is no longer available. The default for the audit log and audit log reports expiration policy is
45 days. You can change this to the number of days required for your configuration. Policies that
were previously set to Never Expire (forever) are changed to 45 days.
Table 32 Events by category
EventCategory
Directory Deleted, File Deleted, File Deleted Admin, File
Modified, File Modified Setattr, File Moved, File Read, File
Renamed
TIP: If files are accessed frequently, you can significantly
enhance system performance and reduce the audit log size
by disabled the File Read event.
Access
Custom Metadata Added, Custom Metadata DeletedArchive API
Audit Event Deleted, Audit Event Disabled, Audit Event
Enabled, Auditing Log Keep Period Changed
Auditing
Filesystem Mounted, Filesystem Unmounted, Segment
Added, Segment Assigned, Segment Unassigned, Tier
Added, Tier Deleted
Configuration
Directory Created, File CreatedFile System
File MigratedMigration
NDMP Backup Started, NDMP Backup Ended, NDMP
Recover Started, NDMP Recover Ended
NDMP
Report Ended, Report StartedReport
File Hold Applied, File Hold Removed, file Retained, File
Retention Period Modified, File WORMed, Autocommit
Retention
Cooloff Cchanged, Autocommit Disabled, Autocommit
Enabled, Retention Mode Changed, Retention Default
Changed, Maximum Retention Changed, Minimum
Retention Changed, File Retention Period Expired
Validation Scan Ended, Validation Scan Started, Validation
Checksum Created, Validation Failed, Validation
Succeeded
Validation
Managing auditing 301