Administration Guides

Advanced Configuration

Home



Save all Reports Centrally to PowerScale Filesystem

  1. This feature allows all reports to be saved as CSV to an nfs mount created on the Eyeglass appliance
  2. igls admin eaCsvArchivePath set --value=/opt/superna/sca/data/EA_reports
  3. Now create an NFS export secured to the ip address of the eyeglass appliance
  4. mkdir /opt/superna/sca/data/EA_reports
  5. chown sca:users /opt/superna/sca/data/EA_reports
  6. chmod 755 /opt/superna/sca/data/EA_reports
  7. Create an NFS mount to the path EA_Reports
  8. example below to mount the report mount 
  9. You will now need to perform the following mount command.
    1. SSH into your Eyeglass appliance and gain root access. sudo -s (then enter the eyeglass password)
    2. Execute the following: vim /etc/fstab
    3. Add the command line below and replace it as indicated:
    4. <Source-cluster-IP>:/<path_of_export> /opt/superna/sca/data/EA_reports nfs rw 0 0
    5. Replacing:
      1. <path_of_export> by path of the NFS Export configured on your Source cluster.
      2. Then execute the previous command using:
      3. mount -a
      4. Navigate to the export to make sure it is writeable
      5. cd /opt/superna/sca/data/EA_reports
      6. ls > test.file
      7. This command should succeed if write access is working.

Filter-Out Event Messages - Turbo Audit

Event Messages can be filtered out from the Audit Event processing to reduce the storage usage as well as the rate of processing events.

  1. To configure the filter, add the following line in the /opt/superna/eca/eca-env-common.conf file
  2. export BYPASSED_EVENT_TYPES=<list of Events to be filter - comma separated>
  3. Default Events Filtered:
  4. To filter-out DIR_SET_ACL,DIR_OPEN,DIR_CLOSE,DIR_SET_SEC events, add this line in the /opt/superna/eca/eca-env-common.conf file
  5. export BYPASSED_EVENT_TYPES=DIR_SET_ACL,DIR_OPEN,DIR_CLOSE,DIR_SET_SEC
  6. Verify that the Turbo Audit mode is also enabled
    1. export USE_TURBOAUDIT=true
    2. The supported list of events that can be specified in the Filter:
    3. FILE_OPEN_NOACCESS
    4. FILE_OPEN_READ
    5. FILE_OPEN_WRITE
    6. FILE_CREATE
    7. FILE_RENAME
    8. FILE_DELETE
    9. FILE_CLOSE
    10. FILE_CLOSE_MODIFIED
    11. FILE_SET_ACL
    12. FILE_READ
    13. FILE_WRITE
    14. DIR_CREATE
    15. DIR_RENAME
    16. DIR_DELETE
    17. DIR_SET_ACL
    18. DIR_OPEN
    19. DIR_CLOSE

How to change the file and directory events supported with Where did my folder go? Feature

  1. 2.5.6 builds after 84 default to the following file and directory events delete,rename.  These events are stored in the Where did my folder go index.   If you need to remove high volume event types, typically file delete events follow these steps.
  2. login to node 1 of the ECA cluster as ecaadmin
  3. nano /opt/superna/eca/eca-env-common.conf
  4. add a line as per example below and remove any events from the list that you no longer want stored in the Where did my folder go index.  NOTE:  This does not remove the events from the main index and the events will still be searchable with the query builder searches.
  5. export EVTARCHIVE_EVENT_TYPES=DIR_RENAME,DIR_DELETE,FILE_DELETE,FILE_RENAME 
  6. Save the file with control + X and answer yes to save
  7. Restart the cluster with ecactl cluster down and then ecactl cluster up to have the changes take effect.


How to increase search concurrency and search performance

  1. In order to increase search performance follow these steps to increase resources.  Search performance is directly related to resources.  
    1. Scenario 1 - Allow concurrent search jobs to run in parallel up to a limit of 5
    2. Scenario 2 - Long running searches that scan many days for many different event types, can exhaust memory.  We recommend to use the specific time interval to search a week at a time or  increase resources to allow for along running search. 
    3. Increase the number of Isilon nodes in the HDFS pool from 3 to 6 or 9 nodes to increase load balancing of IO requests.
    4. (Required) Increase RAM on ECA nodes 2-N to 32 GB, open a case to have memory allocation changed for the search engine spark-workers and spark master containers.  This is required to allocate the memory to searching.
    5. (Required) Increase CPU cores from 4 to 8 per VM on nodes 2-N.  This is required for concurrent jobs.
    6. (optional) Increase the number of ECA nodes and expand the cluster size, if using 6 VM's increase to 9 VM's Deploy another ECA ova following the installation guide.  Open a case to get the cluster expanded.   This increases the database and the search engine and has the highest impact on search performance.
  2. Contact Support once resources have been assigned to the VM's
© Superna Inc