Administration Guides

Bulk Ingest old Audit Data from Isilon to Easy Auditor

Home


Overview

Use these instructions to re-ingest audit data from Isilon's audit directory into Easy Auditor's index.


IMPORTANT: Maximum number of files that can be added to json file to be run at any time = 10. ANY HIGHER NUMBER IS NOT SUPPORTED. Initial testing should be done with only 1 file. Use cron to run at non-busy time.

Isilon Steps

  1. SSH to the Isilon cluster you intend to re-ingest audit logs from
  2. Navigate to the directory you intend to re-ingest audit logs from. This directory is at the bottom of the below path (choose node8 as it was the most recent but yours will vary):
    cd /ifs/.ifsvar/audit/logs/node008/protocol

  3. List the contents. This will assist determining which audit data based on dates/times to re-ingest. The audit logs are listed as .gz files.
    ls -lT


Eyeglass steps

  1. SSH to Eyeglass CLI as admin
  2. Navigate to
    cd /home/admin
  3. Create a file
    touch bulkingest.json
  4. Open the file in vim editor
    vim bulkingest.json
  5. Copy paste content below (if ingesting from a single node), substituting in the following for your own:
    [{
     "cluster_name": "YOUR_ISILON_CLUSTER_NAME",
     "cluster_guid": "YOUR_ISILON_CLUSTER_GUID",
     "node": [{
         "node_id": "node008",
         "audit_files": ["node_audit_file.gz", "node_audit_file.gz"]
       }
     ]
    }]

  6. Save the file
    :wq!
  7. If you wish to ingest from multiple nodes, please use the below code

    EXAMPLE:

    [{
     "cluster_name": "YOUR_ISILON_CLUSTER_NAME",
     "cluster_guid": "YOUR_ISILON_CLUSTER_GUID",
     "node": [{
         "node_id": "node008",
         "audit_files": ["node_audit_file.gz", "node_audit_file.gz"]
       },
       {
         "node_id": "node003",
         "audit_files": ["node_audit_file.gz", "node_audit_file.gz, "node_audit_file.gz", "node_audit_file.gz"]
       }
     ]
    }]



  8. Save the file
    :wq!
  9. Execute the bulkingest.json file (must be absolute path, does not matter where the file is located):

    igls rswsignals bulkLoadTAEvents --file=/home/admin/bulkingest.json

    NOTE: Depending on how large a period of time is being ingested, it can take some time to complete.
Copyright Superna LLC