Hitachi Command Suite

Hitachi Command Suite

Audit Log Reference Guide

Document Organization

Product Version

Getting Help

Contents

© 2014 Hitachi, Ltd. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or by any means,

electronic or mechanical, including photocopying and recording, or stored in a database or retrieval system for any purpose without the express written permission of Hitachi, Ltd.

Hitachi, Ltd., reserves the right to make changes to this document at any time without notice and assumes no responsibility for its use. This document contains the most current information available at the time of publication. When new or revised information becomes available, this entire

document will be updated and distributed to all registered users.

Some of the features described in this document might not be currently available. Refer to the most recent product announcement for information about feature and product availability, or contact Hitachi Data Systems Corporation at https://portal.hds.com.

Notice: Hitachi, Ltd., products and services can be ordered only under the terms and conditions of

the applicable Hitachi Data Systems Corporation agreements. The use of Hitachi, Ltd., products is governed by the terms of your agreements with Hitachi Data Systems Corporation.

Hitachi is a registered trademark of Hitachi, Ltd., in the United States and other countries. Hitachi Data Systems is a registered trademark and service mark of Hitachi, Ltd., in the United States and other countries.

Archivas, Essential NAS Platform, HiCommand, Hi-Track, ShadowImage, Tagmaserve, Tagmasoft, Tagmasolve, Tagmastore, TrueCopy, Universal Star Network, and Universal Storage Platform are registered trademarks of Hitachi Data Systems.

AIX, AS/400, DB2, Domino, DS6000, DS8000, Enterprise Storage Server, ESCON, FICON, FlashCopy, IBM, Lotus, MVS, OS/390, RS/6000, S/390, System z9, System z10, Tivoli, VM/ESA, z/OS, z9, z10, zSeries, z/VM, and z/VSE are registered trademarks or trademarks of International Business Machines Corporation.

All other trademarks, service marks, and company names in this document or web site are properties of their respective owners.

Microsoft product screen shots are reprinted with permission from Microsoft Corporation.

Notice on Export Controls. The technical data and technology inherent in this Document may be

subject to U.S. export control laws, including the U.S. Export Administration Act and its associated regulations, and may be subject to export or import regulations in other countries. Reader agrees to comply strictly with all such regulations and acknowledges that Reader has the responsibility to obtain licenses to export, re-export, or import the Document and any Compliant Products.

Contents

Preface... xv

Intended audience...xvi

Product version... xvi

Release notes...xvi

Document revision level... xvi

Document organization... xvi

Related documents... xvii

Document conventions... xviii

Conventions for storage capacity values... xix

Accessing product documentation...xix

Getting help...xx

Comments... xx

1 Hitachi Command Suite audit logs...1-1

Generating audit log files...1-2

Information included in audit logs...1-3

Editing the audit log environment settings file...1-14

Checking audit log data... 1-17

Message text in audit log data... 1-19

Message text for Common Component processing... 1-19

Message text for Device Manager server processing...1-20

Message text output when related products are started...1-21

Message text for Device Manager server processing using CIM... 1-23

Message text for Tiered Storage Manager processing... 1-25

Message details for Device Manager server requests... 1-32

Commands in message details...1-33

Targets in message details...1-33

Options in message details...1-36

Parameters in message details... 1-39

Correlation between user operations and Tiered Storage Manager CLI audit log data

... 1-56

2 VSP G1000 audit logs...2-1

Overview...2-2

Features... 2-2

Audit Log file description... 2-3

Audit log file format... 2-4

Log output formats for different versions...2-9

Syslog file format... 2-10

Syslog file format (RFC3164-compliant)...2-10

Syslog file format (RFC5424-compliant)...2-14

3 Using VSP G1000 audit logs...3-1

Starting Device Manager - Storage Navigator by logging in to Hitachi Command Suite. 3-2

Downloading audit log files...3-3

Downloading syslog files... 3-4

Automatically transferring audit log files to FTP servers... 3-4

Completing SIM generated when FTP transfer of audit log files failed... 3-6

Manually transferring audit log files to FTP servers...3-6

Transferring audit log to syslog servers... 3-7

4 VSP G1000 audit logs quick reference... 4-1

Audit Log Functions... 4-2

Device Manager - Storage Navigator and SVP operation... 4-2

Encryption Key operation...4-12

Command sent from the host...4-14

PIN Deletion Tool operation...4-15

Audit log reproduced output... 4-15

Audit log lost output ...4-15

5 VSP G1000 audit log examples...5-1

Audit Log Descriptions...5-3

[AuditLog] Create File... 5-3

[AuditLog] DKCAuditLog was lost...5-3

[AuditLog] Over MaxLine...5-3

[AuditLog] Over Threshold... 5-4

[AuditLog] Send Test Message... 5-4

[AuditLog] Set FTP Server... 5-4

[AuditLog] Set Syslog Server... 5-5

[AuditLog] SIM Complete... 5-6

ACM Descriptions...5-7

[ACM] Add Users... 5-7

[ACM] Assign Resource Grps... 5-7

[ACM] Assign Roles...5-8

[ACM] Change Password... 5-9

[ACM] Create User...5-9

[ACM] Create User Grp...5-10

[ACM] Delete User Grps... 5-10

[ACM] Delete Users...5-11

[ACM] Edit User...5-11

[ACM] Edit User Grp...5-12

[ACM] Remove Users... 5-12

[ACM] Set Login Message...5-13

[ACM] Setup Server... 5-13

BASE Descriptions...5-18

[BASE] Certificate Update...5-18

[BASE] ControlPanel Backup... 5-18

[BASE] ControlPanel Restore... 5-19

[BASE] Create Conf Report... 5-19

[BASE] Delete CVAE Info...5-20

[BASE] Delete Reports... 5-20

[BASE] Delete Tasks... 5-21

[BASE] Disable Auto Delete... 5-21

[BASE] Edit Alert Setting... 5-22

[BASE] Edit SIM Syslog Serv...5-22

[BASE] Edit Storage System...5-23

[BASE] Edit System Options...5-24

[BASE] Enable Auto Delete... 5-24

[BASE] Entry Tasks... 5-25

[BASE] Environment Setting... 5-25

[BASE] HCSSO Authentication...5-26

[BASE] HCSSO SetOneTimeKey...5-26

[BASE] Login... 5-27

[BASE] Logout...5-27

[BASE] Release HTTP Block... 5-27

[BASE] Resume Tasks... 5-27

[BASE] Set CVAE Info... 5-28

[BASE] Set Up HTTP Block...5-29

[BASE] Suspend Tasks... 5-29

[BASE] Unlock Forcibly...5-30

[BASE] Update HCS Crt... 5-30

[BASE] Update SMIS CrtFiles... 5-30

[BASE] Upload SMIS ConfFile...5-31

Compatible PAV Descriptions... 5-31

[CPAV] Add Alias... 5-31

[CPAV] Delete Alias...5-32

E-Mail Descriptions...5-32

[E-Mail] MailAddress Write...5-32

[E-Mail] Valid Flag Update... 5-33

Information Descriptions... 5-34

[Information] Delete Log...5-34

[Information] ORM Value... 5-34

[Information] SIM Complete... 5-36

[Information] SIM Reporting Option... 5-36

[Information] Threshold Value...5-37

Install Descriptions...5-39

[Install] Add Host Group... 5-39

[Install] Add LU Path...5-39

[Install] Add WWN...5-40

[Install] All Config...5-40

[Install] Backup Config...5-41

[Install] Change Host Group... 5-41

[Install] Change WWN... 5-42

[Install] DCR Prestaging... 5-42

[Install] Define Config... 5-42

[Install] Delete DKC WWN...5-42

[Install] Delete Host Group...5-43

[Install] Delete LU Path...5-43

[Install] Delete WWN... 5-44

[Install] Dku Emulation... 5-44

[Install] FlashDrive ORM Value...5-45

[Install] Force Reset...5-45

[Install] Format... 5-46

[Install] Format Stop...5-46

[Install] Initialize ORM Value... 5-47

[Install] Install...5-47

[Install] Install CV...5-54

[Install] Machine Install Date...5-55

[Install] Make Volume... 5-55

[Install] Micro Program... 5-56

[Install] MP Install... 5-57

[Install] M/F DCR...5-57

[Install] Open DCR...5-58

[Install] Remove...5-59

[Install] Restore Config... 5-63

[Install] Set Battery Life... 5-64

[Install] Set Channel Speed... 5-65

[Install] Set CommandDev...5-65

[Install] Set CommandDevSec... 5-65

[Install] Set DevGrpDef... 5-66

[Install] Set Fibre Address... 5-66

[Install] Set Fibre Topology... 5-67

[Install] Set Host Mode... 5-67

[Install] Set IP Address... 5-68

[Install] Set Security Switch...5-69

[Install] Set Subsystem Time... 5-69

[Install] Set UserAuth...5-71

[Install] System Option... 5-71

[Install] System Tuning... 5-72

[Install] Update Config...5-73

[Install] Volume to Space... 5-74

Local Replication Descriptions... 5-74

[Local Replication] Create pairs...5-74

[Local Replication] Delete pairs...5-75

[Local Replication] Edit Options... 5-76

[Local Replication] Initialize... 5-78

[Local Replication] Release Reserved CTG... 5-78

[Local Replication] Reserve CTG... 5-78

[Local Replication] Resync pairs...5-79

[Local Replication] Split pairs...5-80

[Local Replication] Suspend pairs...5-81

Maintenance Descriptions... 5-82

[Maintenance] Blockade... 5-82

[Maintenance] Correction Copy...5-82

[Maintenance] DMA Restore... 5-83

[Maintenance] Drive Interrupt... 5-83

[Maintenance] DRR Restore...5-83

[Maintenance] Format...5-84

[Maintenance] Format Stop... 5-84

[Maintenance] MP Restore...5-85

[Maintenance] PCB Restore... 5-85

[Maintenance] Pre QuickFormat Stop... 5-85

[Maintenance] Quick Format...5-86

[Maintenance] Replace...5-86

[Maintenance] Restore... 5-88

[Maintenance] Restore Data... 5-88

[Maintenance] Set Battery Life...5-89

[Maintenance] Size Change... 5-89

[Maintenance] Spare Disk...5-90

[Maintenance] Switch SVP...5-90

[Maintenance] Transfer Config...5-90

[Maintenance] Type Change... 5-90

[Maintenance] Verify...5-91

[Maintenance] Verify Stop... 5-91

Monitor Descriptions...5-92

[Monitor] Threshold... 5-92

Performance Monitor Descriptions... 5-93

[PFM] DCR Prestaging...5-93

[PFM] Delete M/F DCR... 5-93

[PFM] Delete Open DCR... 5-94

[PFM] Delete Unused WWNs...5-94

[PFM] Edit CU Monitor Mode...5-94

[PFM] Edit Monitoring SW...5-95

[PFM] Edit WWN...5-95

[PFM] Edit WWN MonitorMode...5-96

[PFM] Set M/F DCR...5-96

[PFM] Set Open DCR...5-97

Program Product Key (PP KEY) Descriptions...5-98

[PP KEY] PP Apply... 5-98

[PP KEY] PP Disable chk...5-99

[PP KEY] PP Enable chk...5-99

[PP KEY] PP Install chk...5-100

[PP KEY] PP Install File chk...5-100

[PP KEY] PP Removal chk... 5-101

[PP KEY] Update License... 5-101

Provisioning Descriptions... 5-102

[PROV] Add Hosts...5-102

[PROV] Add LUN Paths...5-102

[PROV] Assign MP Blade...5-103

[PROV] Block LDEVs...5-103

[PROV] Complete SIMs...5-104

[PROV] Create Host Groups... 5-104

[PROV] Create LDEVs...5-105

[PROV] Create Resource Grps...5-107

[PROV] Create VDKC-Box... 5-107

[PROV] Create/Expand Pools... 5-108

[PROV] Delete Host Groups... 5-110

[PROV] Delete LDEVs... 5-110

[PROV] Delete Login WWNs...5-112

[PROV] Delete LUN Paths... 5-112

[PROV] Delete Resource Grps... 5-112

[PROV] Delete VDKC-Box... 5-113

[PROV] DRU Expiration-Lock...5-113

[PROV] Edit Cmd Dev(Auth)... 5-114

[PROV] Edit Cmd Dev(DevGrp)... 5-114

[PROV] Edit Cmd Dev(Sec)... 5-114

[PROV] Edit Command Devices... 5-115

[PROV] Edit DRU Attribute...5-115

[PROV] Edit Host... 5-116

[PROV] Edit Host Grps(Mode)... 5-117

[PROV] Edit Host Grps(Name)...5-120

[PROV] Edit LDEVs(tier)... 5-120

[PROV] Edit LDEV Tier Rank... 5-121

[PROV] Edit MP Blades... 5-122

[PROV] Edit Ports(Address)...5-122

[PROV] Edit Ports(Attr)...5-124

[PROV] Edit Ports(Security)... 5-124

[PROV] Edit Ports(Speed)... 5-125

[PROV] Edit Ports(Topology)...5-125

[PROV] Edit Resource Grp... 5-125

[PROV] Edit SCP Time... 5-126

[PROV] Edit Tiering Policy...5-126

[PROV] Edit VR Attribute... 5-127

[PROV] Edit V-VOL Option... 5-128

[PROV] Edit/Delete Pools...5-129

[PROV] Edit/Delete UUIDs... 5-131

[PROV] Expand V-VOLs... 5-131

[PROV] Format LDEVs... 5-132

[PROV] Format LDEVs(H)... 5-132

[PROV] Format LDEVs(Q)... 5-133

[PROV] Initialize Pools...5-133

[PROV] LDEV Name... 5-133

[PROV] Monitor Pools...5-134

[PROV] Move Resources... 5-134

[PROV] Pool Name...5-136

[PROV] Reclaim Zero Pages... 5-136

[PROV] Release HostReserved... 5-137

[PROV] Relocate Pool...5-137

[PROV] Remove Hosts...5-138

[PROV] Restore LDEVs... 5-138

[PROV] Restore Pools...5-139

[PROV] Set FCSP Host...5-139

[PROV] Set FCSP Port Info...5-140

[PROV] Set FCSP Port Switch... 5-140

[PROV] Set FCSP Target...5-141

[PROV] Set PageTieringLevel... 5-141

[PROV] Set SSID...5-142

[PROV] Set Virtual LDEV...5-143

[PROV] Shrink Pool... 5-144

[PROV] Stop Monitoring...5-145

[PROV] Stop Reclm ZeroPages...5-145

[PROV] Stop Relocating...5-145

[PROV] Stop Shrinking Pool... 5-146

[PROV] VTOC... 5-146

Remote Maintenance Descriptions... 5-147

[Remote Maintenance] PS Control...5-147

[Remote Maintenance] Reboot MP... 5-147

[Remote Maintenance] Reboot Port...5-148

[Remote Maintenance] Reboot SVP... 5-148

[Remote Maintenance] Switch SVP...5-148

[Remote Maintenance] Transfer Config...5-148

Remote Replication Descriptions...5-148

[Remote Replication] Add path... 5-148

[Remote Replication] Add Quorum Disk ID...5-150

[Remote Replication] Add RCU...5-151

[Remote Replication] Change JNL Option...5-152

[Remote Replication] Change Mirror Option... 5-153

[Remote Replication] Change RCU Option...5-154

[Remote Replication] Clear SIM...5-156

[Remote Replication] Create Pairs... 5-156

[Remote Replication] Delete Cmd.Dev... 5-162

[Remote Replication] Delete Pairs... 5-162

[Remote Replication] Delete path...5-166

[Remote Replication] Del Quorum Disk ID... 5-168

[Remote Replication] Delete RCU... 5-168

[Remote Replication] Edit Options...5-169

[Remote Replication] Edit Pair Options... 5-173

[Remote Replication] Journal Owner...5-176

[Remote Replication] Journal Vol...5-176

[Remote Replication] R-Cmd.Dev... 5-180

[Remote Replication] Resync Pairs... 5-180

[Remote Replication] Split Pairs... 5-185

[Remote Replication] Suspend Pairs... 5-189

SNMP Descriptions... 5-190

[SNMP] Edit SNMP Agent...5-190

Server Priority Manager Descriptions...5-192

[SPM] Change SPMGrp... 5-192

[SPM] Clear SPM Info...5-192

[SPM] Default Set... 5-193

[SPM] Set All Prio Port...5-193

[SPM] Set All Prio WWN...5-193

[SPM] Set Ctrl Kind... 5-194

[SPM] Set Prio Port... 5-194

[SPM] Set Prio WWN... 5-195

[SPM] SPMGrp Del/Chg... 5-196

[SPM] Update Port WWN... 5-197

[SPM] Update SPMGrp...5-197

[SPM] Update WWN...5-198

Spreadsheet Descriptions...5-199

[Spreadsheet] CflSet End...5-199

[Spreadsheet] CflSet Start... 5-199

Universal Volume Manager Descriptions...5-199

[UVM] Add External Volumes... 5-199

[UVM] Assign MP Blade... 5-202

[UVM] Delete ES VOLs...5-202

[UVM] Disconnect ES Paths... 5-203

[UVM] Disconnect ES VOLs... 5-203

[UVM] Edit ES Path Config... 5-204

[UVM] Edit ES VOLs... 5-205

[UVM] Edit External WWNs...5-207

[UVM] Merge ES Path Grps... 5-207

[UVM] ProfileUpgrade...5-208

[UVM] Reconnect ES Paths... 5-208

[UVM] Reconnect ES VOLs...5-209

[UVM] Split ES Path Grp... 5-209

Volume Migration Descriptions... 5-210

[VM] Delete All Histories...5-210

[VM] Del Migration Plans... 5-210

[VM] Migrate Volumes...5-211

Virtual Partition Manager Descriptions...5-212

[VPM] Edit CLPR... 5-212

Volume Shredder Descriptions...5-213

[VS] Abort Shredding... 5-213

[VS] End Shredding...5-213

[VS] Shred LDEVs... 5-214

Compatible XRC Descriptions...5-215

[XRC] Set XRC Option... 5-215

6 Audit log examples of encryption key operations...6-1

ENC Descriptions... 6-2

[ENC] Add keys to DKC ...6-2

[ENC] Backup Keys ...6-2

[ENC] Backup Keys to File... 6-2

[ENC] Backup Keys to Serv...6-2

[ENC] Change CEK Status... 6-3

[ENC] Change DEK Status... 6-4

[ENC] Clear Keys... 6-4

[ENC] Create KEK Dynamic... 6-4

[ENC] Create Keys...6-5

[ENC] Create Keys...6-5

[ENC] Create Keys On Serv... 6-6

[ENC] DEK assign SpareDisk...6-7

[ENC] DEK delete... 6-7

[ENC] Delete KEK Dynamic...6-7

[ENC] Delete Keys... 6-8

[ENC] Delete Keys... 6-8

[ENC] Delete Keys on Serv... 6-8

[ENC] Edit Encryption... 6-9

[ENC] Edit ENC Settings...6-9

[ENC] Edit Password Policy...6-10

[ENC] Register KEK Dynamic... 6-11

[ENC] Rekey CEK...6-11

[ENC] Rekey KEK Dynamic ... 6-11

[ENC] Restore Keys ...6-11

[ENC] Restore Keys fr File... 6-12

[ENC] Restore Keys fr Serv...6-12

[ENC] Retry KEK Dynamic ... 6-13

[ENC] Set Up Key Mng Serv...6-13

[ENC] Use Keys for CEK/KEK... 6-14

KEK Acquisition Descriptions... 6-14

[KEK Acquisition] Acquisition Key... 6-14

[KEK Acquisition] Set Key... 6-14

7 Audit log examples of commands received by VSP G1000 ...7-1

Config Command (Open system)...7-2

Add Copy Group... 7-2

Add Device Group...7-2

Add Device Group(Nick Name)...7-3

Add DP Pool...7-3

Add External Group... 7-4

Add Host Group...7-5

Add Journal(Ldev)... 7-5

Add Ldev... 7-6

Add Ldev(Dynamic Provisioning)...7-6

Add Ldev(Snapshot)... 7-7

Add LUN... 7-7

Add Path...7-8

Add RCU... 7-8

Add RCU Path...7-9

Add Resource(Group)...7-10

Add Resource/Delete Resource... 7-10

Add Snap Pool... 7-11

Add Snapshot...7-12

Add SPM Group... 7-12

Add SPM WWN... 7-13

Add SSID... 7-13

Add WWN... 7-14

Check External Storage Group... 7-14

Check External Storage Path...7-15

CTQM... 7-15

Delete Copy Group...7-16

Delete Device Group... 7-16

Delete External Group... 7-17

Delete Host Group... 7-17

Delete Journal... 7-18

Delete Journal(Ldev)...7-18

Delete Ldev...7-19

Delete LUN...7-19

Delete Path... 7-20

Delete Pool...7-21

Delete Pool(Ldev)... 7-21

Delete RCU...7-22

Delete RCU Path... 7-22

Delete Resource(Group)... 7-23

Delete Snapshot... 7-23

Delete SPM Group...7-24

Delete SPM WWN... 7-24

Delete SPM WWN(Nick Name)... 7-25

Delete SSID...7-25

Delete WWN...7-26

Disconnect External Group... 7-26

Disconnect Path...7-27

Extend Ldev... 7-27

Initialize Ldev(Format)... 7-28

Initialize Ldev(Shredding)...7-28

Initialize Ldev(Stop Shredding)... 7-29

Map Resource(LDEV)... 7-29

Map Resource(Port)... 7-30

Modify CLPR...7-30

Modify Device Group(Name)...7-31

Modify External Group(ALUA Switch)...7-31

Modify External Group(Cache Inflow)... 7-32

Modify External Group(Cache Mode)... 7-32

Modify External Group(Load Balance Mode)...7-33

Modify External Group(MP Blade)...7-33

Modify Host Group(Host Mode)...7-34

Modify HostGroup(Host Mode Option)... 7-34

Modify Journal...7-35

Modify Journal(MP Blade)... 7-35

Modify Ldev(Blocked)...7-36

Modify Ldev(CLPR)...7-36

Modify Ldev(Command Device)...7-37

Modify Ldev(Discard Zero Page)...7-37

Modify Ldev(MP Blade)...7-38

Modify Ldev(Nick Name)... 7-38

Modify Ldev(Quorum Disable)...7-39

Modify Ldev(Quorum Enable)...7-39

Modify Ldev(Restore)... 7-40

Modify Ldev(SSID)...7-40

Modify Ldev(Tier)... 7-41

Modify Pool Attribute...7-41

Modify Pool(Restore)...7-42

Modify Pool(Threshold)... 7-42

Modify Port...7-43

Modify Port Attribute...7-43

Modify RCU... 7-44

Modify Snapshot(Restore)... 7-45

Modify Snapshot(Resync)... 7-45

Modify Snapshot(Split)... 7-46

Modify SPM Group... 7-46

Modify SPM WWN... 7-47

Modify SPM WWN(NickName)...7-47

Monitor Pool...7-48

Paircreate...7-48

Pairresync... 7-49

Pairsplit...7-50

Pairsplit-S...7-52

Reallocate Pool(Start)... 7-53

Reallocate Pool(Stop)...7-53

Rename Pool... 7-54

Reset Command Status... 7-54

Reset Ldev Priority...7-54

Reset WWN...7-55

Set Ldev Priority... 7-56

Set WWN... 7-56

Stop Monitor Pool... 7-57

Unmap Resource(LDEV)... 7-57

Unmap Resource(Port)...7-58

Config Command (Mainframe system)... 7-58

Business Continuity Manager... 7-59

Add CTG...7-59

Add Pair...7-59

Add RCU...7-60

At-time Split...7-61

Build Command Device... 7-61

Delete Command Device... 7-62

Delete CTG... 7-62

Delete Pair...7-63

Delete RCU... 7-64

EXCTG...7-64

Freeze... 7-65

Remote DKC Control...7-66

Resume Pair...7-66

Run... 7-67

Suspend Pair...7-68

Suspend Pairs... 7-68

M Series...7-69

DEL PATH... 7-69

EST PAIR... 7-69

EST PATH... 7-70

SPLIT PAIRS... 7-71

SUSP PAIR...7-71

TERM PAIR... 7-72

FC-SP...7-72

User Auth...7-73

8 Audit log examples of PIN Deletion Tool operation... 8-1

[PINDeletion] Delete... 8-2

A VSP G1000 audit log user operations... A-1

Logging in or out... A-2

Using Maintenance menu... A-2

Using Actions menu... A-3

Using Reports menu...A-15

Using Settings menu... A-17

Using Resource Lock menu...A-21

Using External API... A-22

When executing single sign-on from Hitachi Command Suite...A-22

B Audit log SVP operations...B-1

Using Maintenance button...B-2

Using Install button... B-3

Using Information button... B-5

Using Monitor button... B-6

C Hitachi Device Manager - Storage Navigator audit log GUI reference...C-1

Audit Log Properties window... C-2

Edit Audit Log Settings wizard... C-3

Edit Audit Log Settings window... C-3

Confirm window... C-9

Preface

This manual explains the settings that are necessary for collecting audit log

data for Hitachi Device Manager (abbreviated hereafter as Device Manager),

Hitachi Tiered Storage Manager (abbreviated hereafter as Tiered Storage

Manager), and the Hitachi Virtual Storage Platform G1000 storage system.

The manual also explains the information that you can check in the audit log

data.

□

Intended audience

□

Product version

□

Release notes

□

Document revision level

□

Document organization

□

Related documents

□

Document conventions

□

Conventions for storage capacity values

□

Accessing product documentation

□

Getting help

Intended audience

This document is intended for storage administrators who use Device

Manager and Tiered Storage Manager to operate and manage storage

systems, and assumes that readers have:

•

Basic knowledge about SANs (Storage Area Networks)

•

Basic knowledge about supported OSs

•

Basic knowledge about Hitachi Virtual Storage Platform G1000

Product version

This document revision applies to the following:

•

Hitachi Device Manager and Hitachi Tiered Storage Manager version 8.0.1

or later

•

Hitachi Virtual Storage Platform G1000

Release notes

Read the release notes before installing and using this product. They may

contain requirements or restrictions that are not fully described in this

document or updates or corrections to this document.

Document revision level

Revision

Date

Description

MK-92HC213-00 April 2014 Initial release

MK-92HC213-01 August 2014 Revision 1, supersedes and replaces MK-92HC213-00

Document organization

The following table provides an overview of the contents and organization of

this document. Click the chapter title in the left column to go to that chapter.

The first page of each chapter provides links to the sections in that chapter.

For details on the audit logs of Hitachi Command Suite, see Chapter 1. For

details on the audit logs of Hitachi Virtual Storage Platform G1000, see

Chapters 2 to 8, and Appendixes A to C. For details on the audit logs of

storage systems except Hitachi Virtual Storage Platform G1000, see the

manual of each storage system.

Chapter/Appendix

Description

Chapter 1, Hitachi Command Suite audit logs on page 1-1

This chapter describes the settings that are necessary for collecting audit log data for Device

Chapter/Appendix

Description

Manager and Tiered Storage Manager, and the information that you can check in the audit log data.

Chapter 2, VSP G1000 audit logs

on page 2-1 Introduces the audit logs created by DeviceManager - Storage Navigator or the SVP (Service Processor) on the storage system. Users can access the audit logs that are output by the SVP, but the SVP itself is accessible only by HDS personnel.

Chapter 3, Using VSP G1000 audit logs on page 3-1

Describes the two types of audit log files and the items included in the files.

Chapter 4, VSP G1000 audit logs

quick reference on page 4-1 Describes the relationship (in a table) between theaudit log functions, operations, and option names in the audit log file. Functions are listed in alphabetical order.

Chapter 5, VSP G1000 audit log

examples on page 5-1 Includes sample audit logs for each function andoperation that can be performed with the Device Manager - Storage Navigator. The logs are listed alphabetically by function name and operation name.

Chapter 6, Audit log examples of encryption key operations on page 6-1

Provides sample audit log for the operation of the key used for data encryption.

Chapter 7, Audit log examples of commands received by VSP G1000 on page 7-1

Provides sample audit logs for the commands issued from the host.

Chapter 8, Audit log examples of PIN Deletion Tool operation on page 8-1

Provides sample audit log for the operation of the PIN deletion tool.

Appendix A, VSP G1000 audit log

user operations on page A-1 Describes user operations and the operation namethat is output to the audit log file.

Appendix B, Audit log SVP operations on page B-1

Describes SVP operations and the operation name that is output to the audit log file.

Appendix C, Hitachi Device

Manager - Storage Navigator audit log GUI reference on page C-1

Describes the audit log features in the Device Manager - Storage Navigator GUI.

Related documents

The following related Hitachi Command Suite and Hitachi Virtual Storage

Platform G1000 documents are available on the documentation CD:

•

Hitachi Command Suite User Guide, MK-90HC172

•

Hitachi Command Suite Installation and Configuration Guide,

MK-90HC173

•

Hitachi Command Suite Administrator Guide, MK-90HC175

•

Hitachi Command Suite Tiered Storage Manager CLI Reference Guide,

MK-90HC177

•

Hitachi Command Suite Messages, MK-90HC178

•

Hitachi Command Suite Mainframe Agent Installation and Configuration

Guide, MK-96HC130

•

Hitachi Virtual Storage Platform G1000 Hardware Guide , MK-92RD8007

•

Hitachi Virtual Storage Platform G1000 Provisioning Guide for Mainframe

Systems , MK-92RD8013

Document conventions

This document uses the following typographic conventions:

Convention

Description

Bold Indicates text on a window, other than the window title, including menus, menu options, buttons, fields, and labels. Example: Click

OK.

Italic Indicates a variable, which is a placeholder for actual text provided by the user or system. Example: copy source-file target-file

Note: Angled brackets (< >) are also used to indicate variables.

Monospace Indicates text that is displayed on screen or entered by the user. Example: # pairdisplay -g oradb

< > angled

brackets Indicates a variable, which is a placeholder for actual text providedby the user or system. Example: # pairdisplay -g <group>

Note: Italic font is also used to indicate variables.

[ ] square

brackets Indicates optional values. Example: [ a | b ] indicates that you canchoose a, b, or nothing. { } braces Indicates required or expected values. Example: { a | b } indicates

that you must choose either a or b.

| vertical bar Indicates that you have a choice between two or more options or arguments. Examples:

[ a | b ] indicates that you can choose a, b, or nothing. { a | b } indicates that you must choose either a or b.

This document uses the following icons to draw attention to information:

Icon

Label

Description

Note Calls attention to important or additional information.

Tip Provides helpful information, guidelines, or suggestions for performing tasks more effectively.

Icon

Label

Description

Caution Warns the user of adverse conditions or consequences (for example, disruptive operations).

WARNING Warns the user of severe conditions or consequences (for example, destructive operations).

Conventions for storage capacity values

Physical storage capacity values (for example, disk drive capacity) are

calculated based on the following values:

Physical capacity unit

Value

1 kilobyte (KB) 1,000 (103_{) bytes}

1 megabyte (MB) 1,000 KB or 1,0002 _bytes

1 gigabyte (GB) 1,000 MB or 1,0003 _bytes

1 terabyte (TB) _{1,000 GB or 1,000}4 _bytes

1 petabyte (PB) _{1,000 TB or 1,000}5 _bytes

1 exabyte (EB) 1,000 PB or 1,0006 _bytes

Logical storage capacity values (for example, logical device capacity) are

calculated based on the following values:

Logical capacity unit

Value

1 block 512 bytes 1 KB 1,024 (210_{) bytes} 1 MB 1,024 KB or 1,0242 _bytes 1 GB _{1,024 MB or 1,024}3 _bytes 1 TB _{1,024 GB or 1,024}4 _bytes 1 PB 1,024 TB or 1,0245 _bytes 1 EB 1,024 PB or 1,0246 _bytes

Accessing product documentation

The Device Manager and Tiered Storage Manager user documentation is

available on the Hitachi Data Systems Portal:

https://portal.hds.com

.

Check this site for the most current documentation, including important

updates that may have been made after the release of the product.

Getting help

Hitachi Data Systems Support Portal is the destination for technical support of

your current or previously-sold storage systems, midrange and enterprise

servers, and combined solution offerings. The Hitachi Data Systems customer

support staff is available 24 hours a day, seven days a week. If you need

technical support, log on to the Hitachi Data Systems Support Portal for

contact information:

https://portal.hds.com

.

Hitachi Data Systems Community is a new global online community for HDS

customers, partners, independent software vendors, employees, and

prospects. It is an open discussion among these groups about the HDS

portfolio of products and services. It is the destination to get answers,

discover insights, and make connections. The HDS Community complements

our existing Support Portal and support services by providing an area where

you can get answers to non-critical issues and questions. Join the

conversation today! Go to

community.hds.com

, register, and complete

your profile.

Comments

Please send us your comments on this document: [email protected].

Include the document title and number, including the revision level (for

example, -07), and refer to specific sections and paragraphs whenever

possible. All comments become the property of Hitachi Data Systems

Corporation.

1

Hitachi Command Suite audit logs

This chapter describes the settings that are necessary for collecting audit log

data for Device Manager and Tiered Storage Manager, and the information

that you can check in the audit log data.

□

Generating audit log files

□

Checking audit log data

Generating audit log files

In the Hitachi Command Suite products, user operations can be recorded in

audit logs to retain proof for auditors and evaluators of compliance with

regulations, security evaluation standards, and other business standards. To

generate audit log data, you must edit the environment settings file

(auditlog.conf). For details on this file, see

Editing the audit log

environment settings file on page 1-14

.

For Windows, the audit log data is output to the event log files (application

log files). For Linux, the data is output to the syslog file.

The following table lists and describes the categories of audit log data that

can be generated from Hitachi storage-related products.

Table 1-1 Categories and descriptions

Categories

Description

StartStop Events indicating starting or stopping of hardware or software:

• Starting or shutting down an OS

• Starting or stopping a hardware component (including micro components)

• Starting or stopping software on a storage system or SVP, and Hitachi Command Suite products

Failure Events indicating hardware or software failures: • Hardware failures

• Software failures (memory error, etc.) LinkStatus Events indicating link status among devices:

• Whether a link is up or down

ExternalService Events indicating communication results between Hitachi storage-related products and external services:

• Communication with an external server, such as NTP or DNS

• Communication with a management server (SNMP) Authentication Events indicating that a device, administrator, or end

user succeeded or failed in connection or authentication: • Fibre Channel login

• Device authentication (Fibre Channel - Security Protocol authentication, iSCSI login authentication, SSL server/client authentication)

• Administrator or end user authentication

AccessControl Events indicating that a device, administrator, or end user succeeded or failed in gaining access to resources: • Access control for devices

• Access control for the administrator or end users ContentAccess Events indicating that attempts to access important data

Categories

Description

• Access to important files on NAS or to contents when HTTP is supported

• Access to audit log files

ConfigurationAccess Events indicating that the administrator succeeded or failed in performing an allowed operation:

• Reference or update of the configuration information • Update of account settings including addition or

deletion of accounts • Security configuration

• Reference or update of audit log settings Maintenance Events indicating that a performed maintenance

operation succeeded or failed:

• Addition or deletion of hardware components • Addition or deletion of software components AnomalyEvent Events indicating that an anomaly, such as a threshold

being exceeded, occurred:

• A network traffic threshold was exceeded • A CPU load threshold was exceeded

• Pre-notification that a limit is being reached or a wraparound occurred for audit log data temporarily saved internally

Events indicating that abnormal communication occurred: • SYN flood attacks to a regularly used port, or

protocol violations

• Access to an unused port (port scanning, etc.)

Different products generate different types of audit log data.

For details on the contents of the output audit log data, see

Checking audit

log data on page 1-17

.

Information included in audit logs

In Device Manager and Tiered Storage Manager, the following categories of

audit events are output to audit logs:

•

StartStop

•

Authentication

•

ConfigurationAccess

•

AccessControl

•

ExternalService

Each audit event is assigned a severity level. You can filter audit log data to

be output according to the severity levels of events.

Table 1-2 Audit events that are output to audit logs (when the category is

StartStop) on page 1-4

to

Table 1-6 Audit events that are output to audit

logs (when the category is ExternalService) on page 1-13

describe the audit

log data that can be generated by Device Manager and Tiered Storage

Manager. For details on the audit log data generated by other Hitachi

Command Suite products, see the manuals for the relevant products.

Table 1-2 Audit events that are output to audit logs (when the category is

StartStop)

Type

description

Audit event

Severity

Message ID

Start and stop

of software Successful SSO server start 6 KAPM00090-I Failed SSO server start 3 KAPM00091-E

SSO server stop 6 KAPM00092-I

Table 1-3 Audit events that are output to audit logs (when the category is

Authentication)

Type

description

Audit event

Severity

Message ID

Administrator or end user

authentication

Successful login 6 KAPM01124-I

Successful login (to the external

authentication server) 6 KAPM02450-I Failed login (wrong user ID or password) 4 KAPM02291-W Failed login (logged in as a locked user) 4 KAPM02291-W Failed login (logged in as a non-existing

user)

4 KAPM02291-W Failed login (no permission) 4 KAPM01095-E Failed login (authentication failure) 4 KAPM01125-E Failed login (to the external

authentication server) 4 KAPM02451-W

Successful logout 6 KAPM08009-I

Automatic

account lock Automatic account lock (repeatedauthentication failure or expiration of account)

4 KAPM02292-W

Table 1-4 Audit events that are output to audit logs (when the category is

ConfigurationAccess)

Type

description

Audit event

Severity

Message ID

User registration (GUI)

Successful user registration 6 KAPM07230-I Failed user registration 3 KAPM07240-E User deletion

(GUI)

Type

description

Audit event

Severity

Message ID

Failed single user deletion 3 KAPM07240-E Successful multiple user deletion 6 KAPM07231-I Failed multiple user deletion 3 KAPM07240-E Password

change (from the administrator window)

Successful password change by the

administrator 6 KAPM07232-I

Failed password change by the administrator

3 KAPM07240-E

Password change

(from the user's own window)

Failed authentication processing for

verifying old password 3 KAPM07239-E Successful change of login user's own

password (from the user's own window) 6 KAPM07232-I Failed change of login user's own

password (from the user's own window)

3 KAPM07240-E Profile change Successful profile change 6 KAPM07233-I

Failed profile change 3 KAPM07240-E Permission

change Successful permission change 6 KAPM02280-I Failed permission change 3 KAPM07240-E Account lock Successful account lock#1 _{6 KAPM07235-I}

Failed account lock 3 KAPM07240-E Account lock

release Successful account lock release

#2 6 KAPM07236-I

Failed account lock release 3 KAPM07240-E Successful account lock release using the

hcmds64unlockaccount command

6 KAPM07236-I Failed account lock release using the

hcmds64unlockaccount command

3 KAPM07240-E Authentication

method change Successful authentication method change 6 KAPM02452-I Failed authentication method change 3 KAPM02453-E Authorization

group addition (GUI)

Successful addition of an authorization

group 6 KAPM07247-I

Failed addition of an authorization group 3 KAPM07248-E Authorization

group deletion (GUI)

Successful deletion of one authorization

group 6 KAPM07249-I

Failed deletion of one authorization group 3 KAPM07248-E Successful deletion of multiple

authorization groups 6 KAPM07249-I Failed deletion of multiple authorization

groups

Type

description

Audit event

Severity

Message ID

Authorization group

permission change (GUI)

Successful change of an authorization group's permission

6 KAPM07250-I Failed change of an authorization group's

permission 3 KAPM07248-E

User registration (GUI and CLI)

Successful registration of user 6 KAPM07241-I Failed to register user 3 KAPM07242-E User information

update (GUI and CLI)

Successful update of user information 6 KAPM07243-I Failed to update user information 3 KAPM07244-E User deletion

(GUI and CLI)

Successful deletion of user 6 KAPM07245-I Failed to delete user 3 KAPM07246-E Authorization

group registration (GUI and CLI)

Successful registration of an authorization group

6 KAPM07251-I Failed registration of an authorization

group 3 KAPM07252-E

Authorization group deletion (GUI and CLI)

Successful deletion of an authorization

group 6 KAPM07253-I

Failed deletion of an authorization group 3 KAPM07254-E Authorization

group permission change (GUI and CLI)

Successful change of an authorization

group's permission 6 KAPM07255-I Failed change of an authorization group's

permission

3 KAPM07256-E

User group registration (CLI)

Successful registration of a user group 6 KAPM07263-I Failed registration of a user group 3 KAPM07264-E User group

deletion (CLI)

Successful deletion of a user group 6 KAPM07265-I Failed deletion of a user group 3 KAPM07266-E User group

update (CLI)

Successful update of a user group 6 KAPM07267-I Failed update of a user group 3 KAPM07268-E Role registration

(CLI)

Successful registration of a role 6 KAPM07269-I Failed registration of a role 3 KAPM07270-E Role deletion

(CLI)

Successful deletion of a role 6 KAPM07271-I Failed deletion of a role 3 KAPM07272-E Role update

(CLI)

Successful update of a role 6 KAPM07273-I Failed update of a role 3 KAPM07274-E

Type

description

Audit event

Severity

Message ID

Assignment of a user account to a user group (CLI)

Successful assignment of the user account to the user group

6 KAPM07275-I Failed assignment of the user account to

the user group 3 KAPM07276-E

Assignment of a permission to a role

(CLI)

Successful assignment of the permission

to the role 6 KAPM07277-I

Failed assignment of the permission to the role 3 KAPM07278-E Assignment of the following three types of items (CLI): • User group and authorizatio n group • Resource group • Role

Successful assignment of the following three types of items:

• User group and authorization group • Resource group

• Role

6 KAPM07279-I

Failed assignment of the following three types of items:

• User group and authorization group • Resource group • Role 3 KAPM07280-E Database backup or restore

Successful backup using the hcmds64backups command

6 KAPM05561-I Failed backup using the hcmds64backups

command

3 KAPM05562-E Successful full restore using the

hcmds64db command

6 KAPM05563-I Failed full restore using the hcmds64db

command

3 KAPM05564-E Successful partial restore using the

hcmds64db command

6 KAPM05565-I Failed partial restore using the hcmds64db

command

3 KAPM05566-E Database export

or import Successful database export 6 KAPM06543-I Failed database export 3 KAPM06544-E Successful database import 6 KAPM06545-I Failed database import 3 KAPM06546-E Database area

creation or deletion

Successful database area creation 6 KAPM06348-I Failed database area creation 3 KAPM06349-E Successful database area deletion 6 KAPM06350-I Failed database area deletion 3 KAPM06351-E

Type

description

Audit event

Severity

Message ID

Authentication data input/ output

Successful data output using the hcmds64authmove command

6 KAPM05832-I Failed data output using the

hcmds64authmove command

3 KAPM05833-E Successful data input using the

hcmds64authmove command

6 KAPM05834-I Failed data input using the

hcmds64authmove command

3 KAPM05835-E Device Manager

server processing

Request reception (normal) 6 KAIC51000-I KAIC51200-I KAIC51201-I Request reception (common/abnormal) 3 KAIC51400-E Response transmission (normal) 6 KAIC51100-I

KAIC51300-I KAIC51301-I KAIC51302-I Response transmission (abnormal) 3 KAIC51500-E

KAIC51700-E KAIC51701-E Startup of

related products (launch)

Request reception (normal) 6 KAIC53000-I Request reception (abnormal) 3 KAIC53200-E Response transmission (normal) 6 KAIC53100-I Response transmission (abnormal) 3 KAIC53300-E Device Manager

server (via CIM) processing

Request reception (normal) 6 KAIC54000-I KAIC54200-I Request reception (abnormal) 3 KAIC54400-E

KAIC54600-E Response transmission (normal) 6 KAIC54100-I

KAIC54300-I Response transmission (abnormal) 3 KAIC54500-E

KAIC54700-E Acquisition of

storage domain information#3

Successful acquisition of all storage

domain information 6 KATS90000-I Failed acquisition of storage domain

information 4 KATS90001-W

Successful acquisition of storage domain

Type

description

Audit event

Severity

Message ID

Failed acquisition of storage domain information

4 KATS90001-W Successful acquisition of all storage

domain summary information 6 KATS90000-I Failed acquisition of all storage domain

summary information 4 KATS90001-W Successful acquisition of storage domain

summary information

6 KATS90000-I Failed acquisition of storage domain

summary information 4 KATS90001-W Successful acquisition of storage domain

refresh status 6 KATS90000-I

Failed acquisition of storage domain refresh status

4 KATS90001-W Acquisition of

migration group information#3

Successful acquisition of all migration

group information 6 KATS90000-I Failed acquisition of all migration group

information 4 KATS90001-W

Successful acquisition of migration group

information 6 KATS90000-I

Failed acquisition of migration group

information 4 KATS90001-W

Acquisition of storage system information#3

Successful acquisition of storage system

information 6 KATS90000-I

Failed acquisition of storage system

information 4 KATS90001-W

Acquisition of task

information#3

Successful acquisition of all task

information 6 KATS90000-I

Failed acquisition of all task information 4 KATS90001-W Successful acquisition of task information 6 KATS90000-I Failed acquisition of task information 4 KATS90001-W Acquisition of

storage tier information#3

Successful acquisition of all storage tier

information 6 KATS90000-I

Failed acquisition of all storage tier

information 4 KATS90001-W

Successful acquisition of storage tier

information 6 KATS90000-I

Failed acquisition of storage tier

information 4 KATS90001-W

Acquisition of pool

information#3

Successful acquisition of pool information 6 KATS90000-I Failed acquisition of pool information 4 KATS90001-W

Type

description

Audit event

Severity

Message ID

Successful acquisition of the number of pools returned from a search

6 KATS90000-I Failed acquisition of the number of pools

returned from a search 4 KATS90001-W Acquisition of

keystore file information#3

Successful acquisition of keystore file

information 6 KATS90000-I

Failed acquisition of keystore file information

4 KATS90001-W Acquisition of

volume information#3

Successful acquisition of volume

information 6 KATS90000-I

Failed acquisition of volume information 4 KATS90001-W Successful acquisition of the number of

volumes returned from a search 6 KATS90000-I Failed acquisition of the number of

volumes returned from a search 4 KATS90001-W Acquisition of

information about unused capacity of parity groups#3

Successful acquisition of parity group information

6 KATS90000-I Failed acquisition of parity group

information 4 KATS90001-W

Successful acquisition of the number of

parity groups returned from a search 6 KATS90000-I Failed acquisition of the number of parity

groups returned from a search

4 KATS90001-W Storage domain

operations#3

Failed registration of a storage domain 4 KATS90001-W Failed deletion of a storage domain 4 KATS90001-W Successful update of storage domain

information 6 KATS90000-I

Failed update of storage domain

information 4 KATS90001-W

Successful update of a storage domain 6 KATS90000-I Failed update of a storage domain 4 KATS90001-W Migration group

operations#3

Successful volume addition to a migration

group 6 KATS90000-I

Failed volume addition to a migration

group 4 KATS90001-W

Successful registration of a migration group

6 KATS90000-I Failed registration of a migration group 4 KATS90001-W Successful deletion of a migration group 6 KATS90000-I Failed deletion of a migration group 4 KATS90001-W

Type

description

Audit event

Severity

Message ID

Successful update of migration group information

6 KATS90000-I Failed update of migration group

information 4 KATS90001-W

Successful creation of a migration plan 6 KATS90000-I Failed creation of a migration plan 4 KATS90001-W Successful deletion of a migration plan 6 KATS90000-I Failed deletion of a migration plan 4 KATS90001-W Task

operations#3 Successful task cancellation 6 KATS90000-I

Failed task cancellation 4 KATS90001-W Successful task status change 6 KATS90000-I Failed task status change 4 KATS90001-W Successful registration of a migration task 6 KATS90000-I Failed registration of a migration task 4 KATS90001-W Successful task registration 6 KATS90000-I Failed task registration 4 KATS90001-W Successful task deletion 6 KATS90000-I Failed task deletion 4 KATS90001-W Successful task execution 6 KATS90000-I Failed task execution 4 KATS90001-W Successful update of task information 6 KATS90000-I Failed update of task information 4 KATS90001-W Storage tier

operations#3

Successful registration of a storage tier 6 KATS90000-I Failed registration of a storage tier 4 KATS90001-W Successful deletion of a storage tier 6 KATS90000-I Failed deletion of a storage tier 4 KATS90001-W Successful update of storage tier

information 6 KATS90000-I

Failed update of storage tier information 4 KATS90001-W

#1:

If an account is locked because the authentication method was changed

for a user whose password is not set, this information is not recorded in

the audit log.

If an account is unlocked because a password was set for a user, this

information is not recorded in the audit log.

#3:

This information is output only by operations from the Tiered Storage

Manager CLI.

Table 1-5 Audit events that are output to audit logs (when the category is

AccessControl)

Type

description

Audit event

Severity

Message ID

Storage domain

operation failure No permission to change a storagedomain 4 KATS90010-W No permission to refresh a storage

domain 4 KATS90010-W

Storage tier

operation failure No permission to create a storage tier 4 KATS90010-W No permission to delete a storage tier 4 KATS90010-W No permission to change a storage tier 4 KATS90010-W Migration group

operation failure No permission to create a migration group 4 KATS90010-W No permission to delete a migration group 4 KATS90010-W No permission to change a migration

group 4 KATS90010-W

No permission to add volumes to a migration group

4 KATS90010-W No permission to delete volumes from a

migration group 4 KATS90010-W

Task operation

failure No permission to create a task 4 KATS90010-W No permission to delete a task 4 KATS90010-W No permission to change a task 4 KATS90010-W No permission to execute a task 4 KATS90010-W No permission to cancel a task 4 KATS90010-W No permission to stop a task 4 KATS90010-W

Note:

This information is output only by operations from the Tiered Storage

Manager CLI.

Table 1-6 Audit events that are output to audit logs (when the category is

ExternalService)

Type

description

Audit event

Severity

Message ID

Communication with the

external authentication server

Successful communication with the LDAP

directory server 6 KAPM10116-I

Failed communication with the LDAP

directory server 3 KAPM10117-E

Successful communication with the RADIUS server

6 KAPM10118-I Failed communication with the RADIUS

server (no response) 3 KAPM10119-E Successful communication with the

Kerberos server 6 KAPM10120-I

Failed communication with the Kerberos

server (no response) 3 KAPM10121-E Successful communication with the DNS

server 6 KAPM10122-I

Failed communication with the DNS

server (no response) 3 KAPM10123-E Authentication

with an external authentication server

Successful TLS negotiation with the LDAP

directory server 6 KAPM10124-I

Failed TLS negotiation with the LDAP

directory server 3 KAPM10125-E

Successful authentication of the user for an information search on the LDAP directory server

6 KAPM10126-I

Failed authentication of the user for an information search on the LDAP directory server 3 KAPM10127-W User authentication on an external authentication server

Successful user authentication on the

LDAP directory server 6 KAPM10128-I User not found on the LDAP directory

server 4 KAPM10129-W

Failed user authentication on the LDAP

directory server 4 KAPM10130-W

Successful user authentication on the

RADIUS server 6 KAPM10131-I

Failed user authentication on the RADIUS

server 4 KAPM10132-W

Successful user authentication on the Kerberos server

6 KAPM10133-I Failed user authentication on the

Type

description

Audit event

Severity

Message ID

Acquisition of information from an external authentication server

Successful acquisition of user information from the LDAP directory server

6 KAPM10135-I Failed acquisition of user information from

the LDAP directory server 3 KAPM10136-E Successful acquisition of the SRV record

from the DNS server 6 KAPM10137-I Failed acquisition of the SRV record from

the DNS server

3 KAPM10138-E

For details about the output format of message text, see

Message text in

audit log data on page 1-19

.

For details about the message text corresponding to each message ID, see

the Hitachi Command Suite Messages.

Editing the audit log environment settings file

To acquire Hitachi Command Suite product audit log data, you must edit the

environment settings file (auditlog.conf). The audit log data can be

generated by setting audit event categories, in Log.Event.Category of the

environment settings file.

To apply the changes to the environment settings file for the audit log, you

need to restart the services of the Hitachi Command Suite products.

Caution: A large volume of audit log data might be output. Change the log

file size and back up or archive the generated log files accordingly.

The auditlog.conf file is stored in the following location:

•

In Windows:

installation-folder-for-Hitachi-Command-Suite\Base64\conf\sec

\auditlog.conf

•

In Linux:

installation-directory-for-Hitachi-Command-Suite/Base64/conf/sec/

auditlog.conf

The following table shows the items you can set in the auditlog.conf file.

Table 1-7 Items set in auditlog.conf file

Item

Description

Log.Facility Specify (by using a number) the facility to be used when the audit log messages are output to the syslog file. Log.Facility is used in combination with the severity levels set for each audit event for filtering the output to the

Item

Description

syslog file. For details about the severity levels output to the audit log, see Table 1-2 Audit events that are output to audit logs (when the category is StartStop) on page 1-4 to

Table 1-6 Audit events that are output to audit logs (when the category is ExternalService) on page 1-13. For details about the values that can be specified for Log.Facility, see Table 1-8 Log.facility values and the corresponding values in syslog.conf on page 1-16. For details about the correspondence between the severity levels set for audit events and those set in the syslog.conf file, see Table 1-9 Correspondence between the severity levels of audit events, the severity levels in syslog.conf, and the types of event log data on page 1-16.

Log.Facility has an effect in Linux only. Log.Facility is ignored in Windows, even if it is specified. Also, if an invalid value or a non-numeric character is specified, the default value is used.

Default value: 1

Log.Event.Category Specify the audit event categories to be generated. When specifying multiple categories, use commas (,) to separate them. In this case, do not insert spaces between categories and commas. If Log.Event.Category is not specified, audit log data is not output. For information about the available categories, see Table 1-2 Audit events that are output to audit logs (when the category is StartStop) on page 1-4 to

Table 1-6 Audit events that are output to audit logs (when the category is ExternalService) on page 1-13.

Log.Event.Category is not case-sensitive. If an invalid category name is specified, the specified file name is ignored.

Default value: (not specified)

Log.Level Specify the severity level of audit events to be generated. Events with the specified severity level or lower will be output to the event log file.

For information about the audit events that are output from Hitachi Command Suite products and their severity levels, see Table 1-2 Audit events that are output to audit logs (when the category is StartStop) on page 1-4 to Table 1-6 Audit events that are output to audit logs (when the category is ExternalService) on page 1-13. For details about the correspondence between the severity levels of audit events and the types of event log data, see Table 1-9 Correspondence between the severity levels of audit events, the severity levels in syslog.conf, and the types of event log data on page 1-16.

Log.Level has an effect in Windows only. Log.Level is ignored in Linux, even if it is specified. Also, if an invalid value or a non-numeric character is specified, the default value is used.

Specifiable values: 0 to 7 (severity level) Default value: 6

The table below shows the values that can be set for Log.Facility and the

corresponding values specified in the syslog.conf file.

Table 1-8 Log.facility values and the corresponding values in syslog.conf

Facility

Corresponding values in syslog.conf

1 user 2 mail# 3 daemon 4 auth# 6 lpr# 16 local0 17 local1 18 local2 19 local3 20 local4 21 local5 22 local6 23 local7

#:

Although you can specify this value, we do not recommend that you

specify it.

The table below shows the correspondence between the severity levels of

audit events, the values indicating severity that are specified in the

syslog.conf file, and the types of event log data.

Table 1-9 Correspondence between the severity levels of audit events, the

severity levels in syslog.conf, and the types of event log data

Severity of audit

events

Severity in syslog.conf

Type of event log data

0 emerg Error 1 alert 2 crit 3 err 4 warning Warning 5 notice Information 6 info 7 debug

The following shows an example of the auditlog.conf file:

# Specify an integer for Facility. (specifiable range: 1-23) Log.Facility 1

# Specify the event category.

# You can specify any of the following:

# StartStop, Failure, LinkStatus, ExternalService, # Authentication, AccessControl, ContentAccess, # ConfigurationAccess, Maintenance, or AnomalyEvent. Log.Event.Category Authentication,ConfigurationAccess # Specify an integer for Severity. (specifiable range: 0-7) Log.Level 6

In the example above, the audit events related to Authentication or

ConfigurationAccess are output. For Windows, Log.Level 6 outputs audit

log data corresponding to the Error, Warning, and Information levels. For

Linux, Log.Facility 1 outputs the audit log data to the syslog file that is

defined as the user facility in the syslog.conf file.

Checking audit log data

•

In Windows:

Audit log data is output to the Windows event log in the following format:

program-name [process-ID]: message-portion

•

In Linux:

Audit log data is output to the syslog file in the following format:

date-time server-name (or IP-address) program-name[process-ID]: message-portion

The format and contents of message-portion are described below.

Note: In message-portion, a maximum of 953 single-byte characters can be

displayed in a syslog file.

The format of message-portion is as follows:

uniform-identifier,unified-specification-revision-number,,message-ID,date-and-

time,detected-entity,detected-location,,audit-event-result,,redundancy- identification-information,agent-information,,request-destination-host,,batch-operation-identifier,,application-identification-information,

Table 1-10 Information in message-portion

Item

_Description

uniform-identifier Fixed to CELFSS.

Item

_Description

message-ID Message ID.

For details, see Information included in audit logs on page 1-3.

date-and-time The date and time when the message was output. This item is output in the format of

yyyy-mm-ddThh:mm:ss.stime-zone. detected-entity Component or process name.

detected-location Host name.

audit-event-type Event type.

audit-event-result Event result.

audit-event-result-subject-identification-information Account ID, process ID, or IP address corresponding tothe event.

hardware-

identification-information Hardware model or serial number.

location-information Identification information for the hardware component.

location-identification-information Location identification information. FQDN Fully qualified domain name.

redundancy-identification-information Redundancy identification information. agent-information Agent information.

request-source-host Host name of the request sender.

request-source-port-number Port number of the request sender.

request-destination-host Host name of the request destination.

request-destination-port-number

Port number of the request destination.

batch-operation-identifier#2 Serial number of operations through the program.

log-data-type-information Fixed to BasicLog or DetailLog.

application-identification-information Program identification information. reserved-area Not output. This is a reserved space.

message-text The contents vary according to the audit events. Characters that cannot be displayed are output as asterisks (*).

For details, see Message text in audit log data on page 1-19.

#1:

#2:

When array information in the message text portion of the Tiered Storage

Manager audit log is output, the basic log data indicating the start of the

array is output first. Next, detailed log data is output one line at a time

for each element of the array, followed by basic log data indicating the

end of the array.

Output example:

However, when the array length is 1, only basic log data is output, and

the detailed log is not used.

Example of message-portion output for a login audit event:

CELFSS,1.1,0,KAPM01124-I,2006-05-15T14:08:23.1+09:00,HBase-SSO,management-host,Authentication,Success,uid=system,,,,,,,,,,,,BasicLog,,,"The login process has completed properly."

Example of message-portion output for a request-received audit event of the

Device Manager server:

CELFSS,1.1,10,KAIC51000-I,2006-03-17T12:45:00.0+09:00,DvM_Srv, TestServer, ConfigurationAccess,Success,uid=system,,,,,,,from=12.228.23.124,,,,,BasicLog,Dv M_GUI,,"123456789 ModPort<SA info='R500-14000'><Port info='0,0,,,1,,'></Port></ SA>"

Message text in audit log data

The format of message text in output audit log data varies from one audit

event to another. This section describes the format of the message text for

each audit event. The item enclosed by square brackets ([ ]) in the format

might not be output.

Message text for Common Component processing

Information about the audit event that occurred is output in a character

string.

For more information on the message text, see Hitachi Command Suite

Messages. The following example shows output message text.

Example of message text output as audit log data when a user logs in: