Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

Forwarding Raw Audit Events from the ECA

Introduction​

This is a different mechanism from alarm forwarding: that page forwards Eyeglass alarms (operational events, alarm codes). This page forwards the raw PowerScale audit event stream the ECA ingests for Data Auditing — the same underlying events queried through Data Auditing — to an external system for long-term retention or SIEM ingestion, independent of the audit database itself.

The ECA runs an optional Docker container, syslogpublisher, that consumes this event stream and can be configured to deliver it two ways:

  • To an external syslog server over UDP, for direct SIEM ingestion.
  • To an S3 bucket, by writing events to a rolling log file on an NFS mount, then archiving that file to S3 using Data Orchestration.

Both use the same syslogpublisher container and configuration file, just with a different output appender.

Forwarding to an External Syslog Server​

  1. SSH to each ECA node that should forward events, as ecaadmin. Each node forwards independently, so repeat this on every node you want to enable (a common pattern is all nodes except node 1).

  2. Edit the syslog appender configuration:

    vim /opt/superna/eca/conf/syslogpublisher/log4j2.xml

    Set the syslog server's IP address and UDP port (default syslog port is 514; the file ships with a placeholder port of 5140 — change it to match your syslog server).

  3. Enable the container to start on the desired nodes by adding it to the Docker Compose overrides file:

    vim /opt/superna/eca/docker-compose.overrides.yml

    Add a syslogpublisher service entry with eca.cluster.launch.all: on under its labels, matching the indentation of existing entries.

  4. Push the configuration to all nodes:

    ecactl cluster push-config

  5. Start the container on the nodes that should forward:

    ecactl cluster exec "ecactl containers up -d syslogpublisher"
    note

    This starts the container on every node, including node 1. If node 1 should not forward, stop and remove it there specifically:

    ecactl containers stop syslogpublisher
    ecactl containers rm syslogpublisher

  6. Monitor forwarding activity from any node running the container:

    ecactl logs --tail 200 --follow syslogpublisher

    This reports the rate of events received and sent, updated roughly every minute.

Example Forwarded Event​

2019-07-07T20:59:40.816Z syslogpublisher.node1.demoeca.eca.local ECA 1 AuditLogs - {"eventCode":"0x40","path":"\\\\<cluster-guid>\\System\\ifs\\data\\policy1\\search\\cow.txt","protocol":"SMB2","server":"node001","clientIP":"..."}

Filtering Before Forwarding​

To forward only a subset of events (for example, a specific path), add a RegexFilter to the Syslog appender in log4j2.xml:

<Syslog name="SupernaSyslog" format="RFC5424" facility="LOCAL0"
  host="<syslog-server-ip>" port="514" protocol="UDP" appName="ECA"
  messageId="AuditLogs" id="Event" connectTimeoutMillis="10000"
  newLine="true" mdcId="mdc" includeMDC="true" enterpriseNumber="18060">
  <RegexFilter regex=".*ifs.*data.*smb01.*test123.*" useRawMsg="true" onMatch="ACCEPT" onMismatch="DENY"/>
</Syslog>

To exclude a path instead of matching one (for example, excluding internal /ifs/.ifsvar housekeeping events), use a negative-lookahead pattern:

<RegexFilter regex="^((?!.*ifsvar.*).)*$" useRawMsg="true" onMatch="ACCEPT" onMismatch="DENY"/>

Path is the most common filter field, but the same RegexFilter approach works against any field present in the raw event JSON (user SID, event code, and so on) — review the example event above to build a pattern for other fields.

After any change to log4j2.xml, push the configuration and restart the container on all nodes:

ecactl cluster push-config
ecactl cluster services restart --container syslogpublisher --all

Troubleshooting​

If your syslog server isn't receiving messages, first confirm firewall access and the configured port, then:

  1. Use the monitoring command above to confirm which ECA node(s) are actively forwarding.

  2. On that node, capture UDP traffic directly:

    sudo -s
    zypper in tcpdump
    tcpdump -i eth0 udp port 514

    A successful send appears as an outbound SYSLOG packet to your configured destination host.

Archiving to an S3 Bucket via Data Orchestration​

For long-term, low-cost retention (for example, to meet HIPAA, PCI, or FedRAMP audit-log retention requirements), route the same event stream to an NFS-mounted rolling log file instead of a syslog server, then use Data Orchestration to archive that file to S3.

Licensing

This requires a Data Security license with Data Auditing, and a Data Orchestration license — the Dropbox archiving feature specifically requires the Pipeline license key.

1. Create the NFS Export on PowerScale​

SSH to the PowerScale cluster as root and create an export in the System Access Zone, with every ECA node IP as both client and root client:

mkdir -p /ifs/syslogpublisher

isi nfs exports create /ifs/syslogpublisher --zone system \
  --root-clients="<ECA_IP_1>,<ECA_IP_2>,...,<ECA_IP_N>" \
  --clients="<ECA_IP_1>,<ECA_IP_2>,...,<ECA_IP_N>" \
  --description "ECA Syslog Publisher Logs"

2. Mount the Export on the ECA Cluster​

  1. SSH to ECA node 1 as ecaadmin and create the local mount point on all nodes:

    ecactl cluster exec "mkdir -p /opt/superna/eca/logs/syslogpublisher"

  2. Add an entry to the ECA's automount configuration, using a SmartConnect name for an IP pool in the System Access Zone (NFSv3 or NFSv4 both work):

    echo -e "\n/opt/superna/eca/logs/syslogpublisher --fstype=nfs,nfsvers=4,soft <FQDN>:/ifs/syslogpublisher" >> /opt/superna/eca/data/audit-nfs/auto.nfs

  3. Push the configuration and mount:

    ecactl cluster push-config
    ecactl cluster exec "sudo systemctl restart autofs"
    ecactl cluster exec "sudo mount -a -t autofs"

    The autofs entry is picked up automatically on subsequent ecactl cluster up runs.

3. Configure syslogpublisher as a Rolling File Appender​

  1. On ECA node 1, back up the existing syslog-forwarding config (if configured) and create a new one:

    ecactl cluster exec "mv /opt/superna/eca/conf/syslogpublisher/log4j2.xml /opt/superna/eca/conf/syslogpublisher/log4j2.xml.original"
    touch /opt/superna/eca/conf/syslogpublisher/log4j2.xml
    vim /opt/superna/eca/conf/syslogpublisher/log4j2.xml

  2. Configure a RollingFile appender, adjusting the roll-over size to your requirement (100 MB shown):

    <?xml version="1.0" encoding="UTF-8"?>
    <Configuration>
      <Properties>
        <Property name="nodeID">${env:ECA_THIS_NODE_ID}</Property>
      </Properties>
      <Appenders>
        <RollingFile name="RollingFile" fileName="logs/${nodeID}/app.log"
          filePattern="logs/${nodeID}/$${date:yyyy-MM}/app-%d{MM-dd-yyyy}-%i.log.gz">
          <PatternLayout>
            <Pattern>%m%n</Pattern>
          </PatternLayout>
          <Policies>
            <TimeBasedTriggeringPolicy />
            <SizeBasedTriggeringPolicy size="100 MB"/>
          </Policies>
        </RollingFile>
      </Appenders>
      <Loggers>
        <Root level="ALL">
          <AppenderRef ref="RollingFile"/>
        </Root>
      </Loggers>
    </Configuration>

    Rolled-over files are compressed and named by node and date, for example logs/6/2025-10/app-10-02-2025-1.log.gz for node 6.

  3. Enable the container on all nodes via the Docker Compose overrides file:

    vim /opt/superna/eca/docker-compose.overrides.yml
    version: '2.4'
    services:
      syslogpublisher:
        labels:
          eca.cluster.launch.all: on

  4. Mount the config and log directories into the container by editing docker-compose.yml's syslogpublisher service, adding under volumes:

    - "/opt/superna/eca/conf/syslogpublisher:/opt/superna/rda/conf:ro"
    - "/opt/superna/eca/logs/syslogpublisher:/opt/superna/rda/logs:rw"

  5. Push the configuration:

    ecactl cluster push-config
    note

    A Permission denied warning on /opt/superna/eca/logs/syslogpublisher during push-config is expected and does not affect functionality. To clear it:

    ecactl cluster exec "ecactl containers exec syslogpublisher chmod 755 logs"

  6. Start the container on all nodes:

    ecactl cluster exec "ecactl containers up -d syslogpublisher"

  7. Confirm events are being written, for example on node 6: /opt/superna/eca/logs/syslogpublisher/6/app.log.

4. Archive the NFS Export to S3 with Data Orchestration​

Configure a Data Orchestration Dropbox folder definition pointed at the NFS export, so its contents are periodically moved to S3 (for example, with a DEEP_ARCHIVE storage tier for cost-optimized long-term retention):

searchctl archivedfolders add --isilon <source-name> --folder /ifs/syslogpublisher \
  --accesskey <access-key> --secretkey <secret-key> \
  --endpoint s3.<region>.amazonaws.com --region <region> \
  --bucket <bucket-name> --cloudtype aws --delete-from-source \
  --tier DEEP_ARCHIVE --type GC

Assign a daily schedule to this folder definition from the Data Orchestration GUI (for example, running at midnight), then test it on demand:

searchctl archivedfolders archive --id <folder-id> --follow

Once the job completes, /ifs/syslogpublisher should be empty — its contents have moved to the configured S3 bucket. See the Data Orchestration Configuration Guide for the full Dropbox/folder-definition workflow.

See Also​