Data Auditing

Overview

Data Auditing provides tools to search, analyze, and monitor file system activity across your Dell PowerScale clusters. Use it for forensic investigation after a security event, compliance reporting, tracking specific user or path activity, or real-time monitoring of live file operations.

PowerScale only

Data Auditing is not available for Dell ECS object storage. It requires the PowerScale audit stream that ECS environments don't produce.

Navigate to Data Auditing in the left sidebar under Data Security.

The page has four tabs:

Tab	Purpose
Queries & Reports	Build, run, save, and schedule audit queries across the cluster.
Where Did My Folder Go?	Quickly locate recently deleted or moved folders and files by path and time window.
WireTap	Stream file system events in real time, filtered by path, user, file extension, or event type.
Bulk Ingest	Load historical audit data from ECA backup files for a specific date.

---

Queries & Reports tab

The Queries & Reports tab is the primary audit search interface. It lets you query the audit database using a range of filters, save queries for reuse, schedule recurring reports, and review the complete history of all report runs.

Page layout

The left panel lists your queries in two groups:

• Built-in Queries — a set of pre-configured queries provided by Superna, covering common audit scenarios such as top data users, user access summaries, deletion reports, and compliance searches. Built-in queries can be run but not edited or deleted.
• Custom Queries — queries you have defined and saved. Each entry shows the target device and path, the run type badge (Manual or Scheduled), and the time since the last run. The right panel shows All Reports — every report run across all queries, with status, query name, completion time, run type, record count, and duration. Use the Status, Report Type, and Run Type filter dropdowns above the list to narrow the results, or use the search field to find a specific report by name.

Report statuses

Status	Meaning
Queued	The report is waiting to start.
Running	Currently executing. A progress counter shows records processed.
Success	Completed and returned results.
Failed	Encountered an error. Review query configuration and cluster connectivity.
Canceled	Manually stopped before completion.

Creating a query

Click + Create Query at the top of the left panel to open a menu listing the built-in queries (see Built-in queries below) plus a Create Custom Query option. Select Create Custom Query to open the filter configuration:

Query Name Required. Letters and numbers only — no spaces or special characters. The query cannot be saved until a valid name is entered.

User Name Leave empty to search across all users. To search for a specific user, enter their username in user@domain or DOMAIN\user format — the domain portion must be uppercase. The system resolves the name to an Active Directory SID, which is used to find SMB audit events.

Path Select the cluster and enter or browse to the directory path to search. Choose a path as close as possible to where the relevant activity occurred. Avoid broad paths like /ifs — they significantly increase query time and return volume.

Event Type Defaults to All Events — the slowest option. Use the dropdown to narrow to specific event types; fewer event types produce faster results, so narrow this before running a broad query.

Extension Filter by file extension. Enter the extension without the leading period — for example pdf, not .pdf. Useful for tracking access to specific file types such as spreadsheets, PDFs, or executables.

Time Range Choose from:

• Days in the past (for example: last 7 days)
• A specific day
• A custom date and time range

Always use the narrowest time range that covers your investigation window. For large time ranges, break the query into smaller sub-ranges and combine the results.

Max Results Default maximum is 50,000 records. The system supports up to 1 million events, but large result sets slow the query and produce large CSV export files. Refine other filters before raising this limit.

Email Notification (optional) When enabled, a notification is sent on report completion — even if no results were returned. Disable for ad hoc queries where email confirmation is not needed.

Click Save & Run to save the query and execute it immediately.

Built-in queries

Built-in queries are pre-configured searches for common operational and compliance use cases. They are available under the Built-in Queries group in the left panel.

To run a built-in query, click it in the left panel to load its configuration, then click Save & Run. You can adjust filters such as time range and path before running, but you cannot save changes to the built-in query itself.

Each query's card in the left panel also has quick-action icons — Run to re-execute it directly without reopening the query builder, plus Duplicate and Delete for custom queries.

Report	Purpose	Parameters	Notes
Stale User Access	Builds a list of users who can mount SMB shares (based on AD group membership) and calculates the last read or write for each share they have access to. Helps identify users who have share access they no longer use.	SMB share, time period to analyze	Long-running on large audit databases or large AD user counts — can take hours.
User Access	Maps users and AD groups to SMB share access, to determine excessive permissions or validate existing share access. AD groups can be expanded to a list of individual users.	SMB share	Run time increases with AD user/group count.
Employee Exit	Shows all files a specific user accessed, by day, over the last 30 days — typically run as part of an HR offboarding process before an employee's last day.	User (user@domain or DOMAIN\user — resolution fails if the SID cannot be found), cluster	In high audit-event-rate environments, a full 30-day window may not complete, or results may be capped at 10,000 records. If the built-in report doesn't finish, narrow the window or reproduce it as a custom query with a shorter time range.

These three names match the product's Create Query menu labels verbatim. Note the interface uses two related but different labels for the first one: the menu item is named Stale User Access, while the query's card is tagged with the shorter category label Stale Access — the tag is the category, the name above is the query itself.

Pair Stale User Access and User Access for access reviews

The Stale User Access and User Access built-in queries are typically most useful together: run User Access first to see who currently has access to a share, then Stale User Access to see which of those users haven't actually used that access recently. Together they give you both sides of a least-privilege access review — who can get in, and who's actually using that access.

Additional built-in categories include per-table row counts (useful for capacity/performance review, can run for hours — schedule off-peak) and general excessive-permissions/top-data-consumer summaries. The full current list is visible in the interface once your clusters are connected.

Saving and scheduling queries

Click Save Query As to store the current configuration under a name of your choice. The query appears in the Custom Queries group and can be run, edited, or scheduled.

To schedule a query:

1. Save the query using Save Query As.
2. Select the saved query in the left panel.
3. Open the Report Schedule section within the query configuration.
4. Choose a recurrence frequency.
5. Confirm the schedule. Scheduled queries show a Scheduled badge in the query list and in the report history.

Known issue — Built-in Queries cannot be scheduled in the New GUI

Scheduling is currently only available for built-in queries in the Old (legacy) GUI. In the New GUI, scheduling works for custom queries/reports, but not yet for built-in queries. To schedule a built-in query today, use Save Query As first to create a custom copy, then schedule that copy as described above. Direct scheduling of built-in queries in the New GUI is planned for a future release. See Release Notes — Known Issues.

Viewing and downloading report results

In the All Reports panel, click the three-dot menu (...) on any completed report row for Download (CSV) or Delete. There is no report viewer in this product — CSV is the only way to review results, and exports contain the full result set up to the configured Max Results limit.

---

Where Did My Folder Go? tab

Where Did My Folder Go? is a focused search tool for locating deleted or moved folders and files. Use it when a user reports that content has disappeared and you need to trace what happened to it quickly, without constructing a full audit query.

How to search

1. In the Path field, select a cluster and enter or browse to the directory path you want to investigate — for example, /ifs/data.
2. Set the Time Frame: choose a duration unit (Hours or Days) and enter a value — for example, In the last 4 Hours.
3. Select the Data Type:
   • Folders — search for folder-level changes.
   • Files/Objects — search for individual file changes.
4. Check Show Deleted Items to include objects that were deleted within the search window.
5. Click Search. Results are limited to 5,000 entries per search. If the maximum is reached, narrow the time frame or path to get a more precise result set.

Click Download CSV to export the results for offline analysis or to share with a user.

---

WireTap tab

WireTap streams file system audit events in real time for a selected cluster and path. Use it for live monitoring during an active investigation, to observe what a specific user is doing right now, or to confirm that audit events are flowing correctly from a cluster.

Casing is intentional

This page spells the tab/feature name WireTap, but the panel and buttons within it (Wiretap Configuration, Start Wiretap, Stop Wiretap, Save Wiretap, Saved Wiretaps) use Wiretap, matching the in-app labels. This is a deliberate distinction between the feature name and the UI element labels, not an inconsistency to fix.

Configuring a WireTap session

In the Wiretap Configuration panel:

1. Path to Monitor — Click the field to select a cluster, then enter or browse to the path you want to monitor.
2. User (optional) — Enter an AD username in DOMAIN\user format to filter the stream to events from that user only. For example: AD5\aneta.
3. File Name (optional) — Filter by filename or a wildcard extension pattern, per the in-app placeholder text — for example: budget.xlsx or *.docx.
4. Event Types (optional) — Use the dropdown to select which event types to include.
5. Subfolders — Checked by default, so events from all subdirectories under the monitored path are included unless you clear it. A WireTap started on a broad path like /ifs with Subfolders left on streams events from everything below it — narrow the path first if you only need one directory. Click Start Wiretap to begin streaming. Events appear as they are processed by the ECA. Click Stop Wiretap to end the session.

Saving a WireTap configuration

Click Save Wiretap to store the current configuration for future reuse. Saved configurations appear in the Saved Wiretaps list at the bottom of the tab, showing the path, filters, and date last used. Click any saved configuration to reload it, then click Start Wiretap to begin.

Note: WireTap shows events from the moment the stream starts — it does not display historical events. To search past activity, use the Queries & Reports tab.

---

Bulk Ingest tab

Bulk Ingest loads historical audit data from ECA backup files for a specific PowerScale cluster and a single target date. Use it when audit data is missing from the database — for example, after an ECA outage — and you need to make that data available for querying.

When to use Bulk Ingest

• The ECA experienced downtime and audit events from that period are not in the database.
• A cluster was recently added to the managed environment and you need historical data from before it was connected.
• A compliance query requires coverage of a period that predates your ECA's continuous ingestion.

Requirements and limitations

Before using Bulk Ingest, review the following constraints:

• Targeted date only: The system supports data ingestion for a specific, targeted date — not days, weeks, or months of data in a single job.
• 3-day window: You can only select files from within the previous 3 days.
• Maximum 20 files per job: Each Bulk Ingest job can process a maximum of 20 .gz audit files. For initial testing, use a single file.
• One concurrent job: The system runs one Bulk Ingest job at a time. Additional jobs are queued.
• Lower priority than live audit data: Active audit data processing always takes precedence over Bulk Ingest. There is no way to predict how long a Bulk Ingest job will take.
• No standard support: Bulk Ingest is a background task and is not covered under the standard support contract.
• Schedule during off-peak hours: Run Bulk Ingest jobs during low-activity periods to minimize impact on active audit processing.

NFS setup — required before first use

Bulk Ingest requires NFS ingestion to be configured on your ECA cluster before the feature can be used. This is a one-time setup.

Step 1 — Create the Bulk Ingest directory on ECA nodes

ecactl cluster exec "sudo mkdir -p /opt/superna/mnt/bulkingestion/<cluster-guid>/<cluster-name>"

Replace <cluster-guid> with your PowerScale cluster's GUID and <cluster-name> with its name. Skip this step if the directory already exists.

Step 2 — Configure a non-default bulk ingest path (if required)

If you are using a non-default path for .gz audit log files, configure it via the Eyeglass CLI:

igls config settings set --tag=bulkingestpath --value=<PATH>

Replace <PATH> with the full directory path on PowerScale where audit logs are stored.

When using a non-default path, organize files in this structure:

/PATH/node-name/protocol/

Each node must have its own subdirectory containing a protocol folder for its .gz files.

Step 3 — Create an NFS export on PowerScale (non-default path only)

Skip this step if the NFS export already exists for the default path.

isi nfs exports create <PATH> \
  --root-clients="<eca-ips>" \
  --clients="<eca-ips>" \
  --read-only=true \
  -f \
  --description "Bulk ingest export" \
  --all-dirs true

Replace <PATH> with your custom path and <eca-ips> with a comma-separated list of all ECA node IP addresses.

Step 4 — Edit the auto NFS configuration on each ECA node

On each ECA node, edit /opt/superna/eca/data/audit-nfs/auto.nfs and add:

/opt/superna/mnt/bulkingestion/<cluster-guid>/<cluster-name> --fstype=nfs,nfsvers=4,ro,soft <FQDN>:<PATH>

• For the default path, replace <PATH> with /ifs/.ifsvar/audit/logs.
• For a non-default path, use the custom path from Step 2.
• Replace <cluster-guid>, <cluster-name>, and <FQDN> with your cluster details.

Step 5 — Apply configuration and restart services

ecactl cluster push-config
ecactl cluster exec "sudo systemctl restart autofs"

Step 6 — Mount the NFS export

ecactl cluster exec "sudo /opt/superna/eca/scripts/manual-mount.sh"

Alternatively, restart the ECA cluster to trigger automatic mounting.

Step 7 — Verify the setup

Test Bulk Ingest through the Eyeglass UI to confirm the NFS mount is working and files are visible.

Running a Bulk Ingest job

Once NFS setup is complete:

1. In the Cluster dropdown, select the PowerScale cluster whose backup audit files you want to ingest.

2. Set the Start Date — the date for which you want to load audit files.

3. Set the Search Previous window — how many days before the start date to search for available backup files (for example: 3 Days).

4. Click Load Files. The system searches the ECA for backup audit log files matching your criteria and displays them in the Audit Files list.

5. Review the files and select those you want to ingest.

6. Confirm to start the job. Track the job status in the Jobs section of the left sidebar. Once ingestion is complete, the audit data is available in the Queries & Reports tab.

Note: Bulk Ingest is supported for PowerScale (Isilon) clusters only.

---

Who audits the auditor?

The Eyeglass appliance logs its own login activity and major UI actions — including actions taken within Data Auditing itself — independent of the PowerScale audit stream Data Auditing queries. This appliance-level audit log is stored on the file system and is included in Eyeglass appliance backup ZIP files. See Appliance Hardening Guide — WebUI Security API Auditing for how to review it (apiaudit.log, correlating actions to a user and source IP via the web server access log).

Best practices

• Use specific paths and short time ranges. The audit database can contain billions of events. Broad queries against top-level paths with multi-week ranges produce unmanageably large results and slow query times significantly.
• Save queries you run regularly. Any query run more than once — weekly access reports, monthly deletion summaries, compliance checks — should be saved and scheduled for consistency.
• Use WireTap to verify audit pipeline health. If you suspect events are not flowing from a cluster, start a WireTap against a known-active path. No events on a busy path is a signal that the ECA or the cluster's audit configuration needs attention.
• Run Bulk Ingest before forensic investigations. If you are investigating an event that occurred before your ECA's continuous coverage began, run Bulk Ingest first to make the relevant data available.
• Treat the 50,000 record default as a ceiling, not a target. If a query consistently returns the maximum, the filters are not specific enough — narrow the user, path, or time range before raising the limit.

Known limitation: case mismatch on SMB subfolder mounts

PowerScale is a case-sensitive file system, but Windows is not. If a client mounts an SMB share at a subfolder path whose case doesn't match the file system exactly (for example, mounting \\cluster\share\TEMP when the actual path on disk is /ifs/data/temp), the resulting audit events are recorded against the mismatched-case path rather than the real one — which can make those events hard to find with an exact-path search. This does not occur if the share itself is mounted (without a subfolder) or if the subfolder's case matches the file system, and NFS is not affected, since NFS denies mounts with mismatched case. There is no PowerScale fix planned for this. If you suspect mismatched-case mounts exist in your environment, start searches from the share's root path rather than a specific subfolder path.

---

See also

• Threat Detections — Use Data Auditing queries to supplement investigation of active security events.
• Active Auditor — Configure policy-based triggers that generate events on the Threat Detections page.
• Health Check — Robo Audit — Continuous automated SMB activity tracking with scheduled reports.
• SQL DB Retention Management — Configure archival thresholds, compression, and cold-storage paths for the underlying audit database, and back up or restore it directly.
• Audit Event Forwarding — Forward the raw PowerScale audit event stream to an external syslog server, or archive it to S3 via Data Orchestration.