6.5 HP StoreAll OS User Guide

The file is in a comma-separated value (CSV) format with a header row. The following table displays
the definitions for the less obvious fields in an audit report.
DescriptionField
The seconds and nanoseconds of that time, in UNIX epoch time, which is the number of seconds
since the start of Jan 1, 1970 in UTC
*time[n]sec
Stores the group ID of the user who does the operations on a file.actorgroupid
Stores the user ID of the user who does the operations on a file.actoruserid
Stores the checksum computed from the content of a file.contenthash
Currently unuseddescription
The ID of the node in the StoreAll cluster that recorded this event a hex string)eshost
Defined in the standard Linux header files errno_base.h and errno.heventerrorcode
Whether the attempted operation succeeded or failedeventsuccess
Stores the checksum computed from the metadata information of a file.metahash
The Linux mode/permission bits (a combination of the values shown by the Linux man 2 stat
command)
mode
The Permanent Object ID that uniquely identifies the file within the StoreAll cluster (a 96-bit
integer split in two parts)
POID_lo32/hi64
The sequence number of this event, increased incrementally for each event processed per node
in the StoreAll cluster
seqno
NOTE: Although you can start several audit report tasks at the same time, the tasks are queued.
Only one task can be in the RUNNING state at a time.
Table 34 Events by category
EventCategory
Directory Deleted, File Deleted, File Deleted Admin, File
Modified, File Modified Setattr, File Moved, File Read, File
Renamed
TIP: If files are accessed frequently, you can significantly
enhance system performance and reduce the audit log size
by disabled the File Read event.
Access
Custom Metadata Added, Custom Metadata DeletedArchive API
Audit Event Deleted, Audit Event Disabled, Audit Event
Enabled, Auditing Log Keep Period Changed
Auditing
Filesystem Mounted, Filesystem Unmounted, Segment
Added, Segment Assigned, Segment Unassigned, Tier
Added, Tier Deleted
Configuration
Directory Created, File CreatedFile System
File MigratedMigration
NDMP Backup Started, NDMP Backup Ended, NDMP
Recover Started, NDMP Recover Ended
NDMP
Report Ended, Report StartedReport
File Hold Applied, File Hold Removed, file Retained, File
Retention Period Modified, File WORMed, Autocommit
Retention
Cooloff Cchanged, Autocommit Disabled, Autocommit
304 Express Query