Hello Dave,
This seems like unexpected behavior, especially the part where you need to disable/re-enable FAL to see the records.
To answer your question
To answer your question
Is it intended for the audit mechanism to be a soft audit? i.e the
audit is best effort, and non blocking for file access.
>>> file audit logging is indeed best effort. We buffer the records in memory and write them out at a later time, therefore non blocking for file accesses. You can verify if any records have been dropped with the "mmdiag --eventproducer" command. This command is per node, and will show if audit messages were dropped in the "Msg failed: " field. Even though audit is enabled on your NSD node, the client nodes where the file accesses happen do the buffering/writing. So make sure to runn the mmdiag --eventproducer command from the node where the file accesses are happening.
Thanks,
| | |
_______________________________________________ gpfsug-discuss mailing list gpfsug-discuss at spectrumscale.org http://gpfsug.org/mailman/listinfo/gpfsug-discuss
