Configuring audit policies

This section outlines the steps to configure the Hitachi NAS file server for file system auditing.

Configure a file system audit policy on a Hitachi NAS EVS

To configure a file system audit policy on each EVS file system that you want to audit, follow the steps below:

• Log in to the Hitachi NAS console using administrator credentials.
• Navigate to Home > File Services > File System Audit Policies.
• Select each EVS / File System that you want to enable auditing for, then click add.
• On the Add File System Audit Policy page, retain the default settings specified, and click OK to save the policy.

Enable auditing for a file system

File system auditing can be enabled on a per-file-system basis. To add a file system to the file system audit list and enable auditing, follow the steps below:

• Log in to the Hitachi NAS console using administrator credentials.
• Navigate to Home > File Services > File System Audit Policies.
• If the file system you want to enable auditing on is listed, an audit policy has already been defined for that file system.
  • If the Audit Policy Status is enabled, logging is already enabled for the file system, and no further actions are required.
  • If the Audit Policy Status is disabled, select the check box next to the file system name, and click enable.



Note: If the file system you want to enable auditing on is not displayed, a file system audit policy may not have been defined for that file system, or the file system might not be in the currently selected EVS.

If the file system you want to enable auditing on is not displayed, click change to go to the Select an EVS page, and select a different EVS.

• After selecting a different EVS, if the file system you want to enable auditing on is now listed on the File System Audit Policies page, select the check box next to the file system name and click enable.
• After selecting a different EVS, if the file system you want to enable auditing on is still not displayed, you must define a file system audit policy for that file system. Click add to go to the Add File System Audit Policy page, and configure an audit policy for the file system.

Modify a file system audit policy

To modify a file system audit policy, follow the steps below:

• Log in to the Hitachi NAS console using administrator credentials.
• Navigate to Home > Files Services > File System Audit Policies.
• Click change to go to the Select an EVS page, and select the EVS hosting the file system with the audit policy you want to change.
• Click the details button on the file system with the audit policy you want to modify.
• On the File System Audit Policy Details page, modify the policy as required.
• Click OK to save the policy as specified.

Disable auditing for a file system

To disable auditing for a file system, follow the steps below:

• Log in to the Hitachi NAS console using administrator credentials.
• Navigate to Home > Files Services > File System Audit Policies.
• Click change to go to the Select an EVS page, and select the EVS hosting the file system with the audit policy you want to disable.
• Select the check box next to the name of the file system with the audit policy you want to disable.
• Click disable to stop the policy from functioning.

Note: When an audit policy is disabled, file system access operations are not logged and protocol restrictions are not enforced. Also, disabling a policy does not delete it.

Check if auditing is enabled on the EVS

To verify if auditing is enabled on the EVS for the required file system, generate some activity on the shares created on the file system. Execute the following command on the Hitachi NAS console to see if the events are generated:

audit-log-show <Name of file system>