PowerScale OneFS Audit Log Purge Procedures

PowerScale stores audit messages in archived, compressed files on the cluster. OneFS does not purge these automatically on releases prior to 9.1, so the audit directory grows indefinitely unless it's managed.

note

These commands act on the PowerScale cluster's own isi audit subsystem, not on Superna's appliance-side databases. Retention of Superna's own SQL event database is managed separately, through the Data Security product's own retention settings.

OneFS 9.1 and later: automatic purging

OneFS 9.1 introduced native automatic purging of audit logs.

Log in to the target cluster as the root user.
Enable automatic purging (defaults to a 180-day retention period):
```
isi audit settings global modify --auto-purging-enabled=yes
```
To retain a longer history, set a custom retention period in days:
```
isi audit settings global modify --retention-period=365
```
To manually delete archived audit data older than a specific date:
```
isi audit logs delete --before=2021-01-01
```

note

This only purges logs. It does not archive the deleted data for long-term retention — export any data you need to keep before purging.

OneFS prior to 9.1: manual archive or purge

Earlier OneFS releases have no automatic purge process. Use this procedure to manually remove old audit archives and confirm the audit protocol resumes normally afterward on every node in the cluster.

warning

This procedure stops audit event capture on the cluster while auditing is disabled. Superna recommends opening a case with Dell/EMC support for guidance on this cluster-side procedure — Superna Support cannot troubleshoot PowerScale-side steps. The procedure must be run as the root user on the cluster.

Stop the ECA cluster. SSH to the ECA master node as ecaadmin, then run:
```
ecactl cluster down
```
Disable audit logging (OneFS 8.0.0 and later):
```
isi audit settings global modify --protocol-auditing-enabled=no
isi audit settings global modify --config-auditing-enabled=no
```
(Only run the config-auditing-enabled command if config auditing was enabled beforehand.)

Stop the audit daemons from automatically restarting:

isi services -a isi_audit_d ignore
isi services -a isi_audit_cee ignore
isi services -a isi_audit_syslog ignore

End the running audit processes across all nodes:

isi_for_array 'pkill isi_audit_d'
isi_for_array 'pkill isi_audit_cee'
isi_for_array 'pkill isi_audit_syslog'

Confirm no audit processes remain running:
```
isi_for_array pgrep -l isi_audit
```
Move the audit directory aside so it can be recreated:
```
cd /ifs/.ifsvar/audit
mv /ifs/.ifsvar/audit /ifs/.ifsvar/audit.bak
```
Archive audit.bak to long-term storage, or delete it after confirming with your compliance team whether the data needs to be retained.
Resume audit daemon monitoring. MCP automatically restarts the daemons and reconstructs the audit directory on each node:
```
isi services -a isi_audit_d monitor
isi services -a isi_audit_cee monitor
isi services -a isi_audit_syslog monitor
```
Confirm the audit processes restarted:
```
isi_for_array -s pgrep -l isi_audit
```
Verify the audit directory was reconstructed:
```
find /ifs/.ifsvar/audit
```

Re-enable audit logging.

OneFS 7.1.0 – 7.2.1:

isi audit settings modify --protocol-auditing-enabled=Yes
isi audit settings modify --config-auditing-enabled=Yes

OneFS 8.0.0 and later:

isi audit settings global modify --protocol-auditing-enabled=Yes
isi audit settings global modify --config-auditing-enabled=Yes

Confirm log files are populating again. Reset the audit log timestamp to the current date and time, then check the last logged event:
```
isi audit settings global modify --cee-log-time "Protocol@2017-11-21 04:13:00"
isi_audit_viewer -t protocol
```
On the ECA master node, as ecaadmin, bring the cluster back up:
```
ecactl cluster up
```
In Eyeglass, verify the Managed Services icon shows the ECA nodes as active and green. Heartbeats can take 2–5 minutes before the ECA cluster shows fully up.
If Ransomware Defender is running, run the Security Guard feature to confirm audit messages are being processed correctly.

OneFS 9.1 and later: automatic purging​

OneFS prior to 9.1: manual archive or purge​

OneFS 9.1 and later: automatic purging

OneFS prior to 9.1: manual archive or purge