Introduction; Purpose Of Audit Logs - HP XP20000/XP24000 Reference Manual

1 Introduction

This chapter introduces the audit logs created by the HP StorageWorks XP Remote Web Console
computer or SVP (Service Processor) on the storage system. The SVP is a computer that is contained
within the storage system. Users can access the audit logs that are output by the SVP, but the SVP
is accessible only by HP personnel.
This chapter includes the following sections:
"Purpose of Audit Logs" (page 12)
"Download the Audit Log Information Files to the Remote Web Console Computer" (page 13)
"Download the Syslog Information File to the Remote Web Console Computer" (page 13)
"Transferring the Audit Log Files to Syslog Servers" (page 15)
"Transferring the Audit Log Files to Syslog Servers" (page 15)
"Storing Audit Logs" (page 17)
"Audit Log File Description" (page 18)
The term storage system in this guide refers to the following disk arrays:
HP StorageWorks XP24000 Disk Array
HP StorageWorks XP20000 Disk Array
The GUI illustrations in this guide were created using a Windows computer with the Internet Explorer
browser. Actual windows may differ depending on the operating system and browser used. GUI
contents also vary with licensed program products, storage system models, and firmware versions.

Purpose of Audit Logs

The audit log is an important tool you can use to keep track of operations, to monitor security, to
investigate the cause of errors, and to avoid potential errors.
Audit log files store a history of the following:
Operations performed from the Remote Web Console computer, SVP, and commands.
Commands that the storage system received from the host.
Operations about Disk Encryption Key for data encryption.
The history may not be output in order of a time series. This history includes the user, the time of
the operation, the name of the operation, any parameters set, and the end result (normal completion
or error message). Each audit log file ends with a serial number, from 0,000,000,000 to
4,294,967,295. When the number reaches 4,294,967,295, it resets and starts over at
0,000,000,000.
There are two types of audit log files:
Audit Log Information File: Consists of basic and detailed information about settings made for
each operation. Items common to each audit log will appear as basic information. See
Log Information File" (page 20)
(page 27)
Syslog Information File: Consists of information released to both the syslog and audit log
information file and information released only to the syslog information file. See
Information File" (page 22)
contains the audit log. You can download it to your Remote Web Console computer or to a
primary or secondary syslog server.
12 Introduction
and
for details about the audit log information file.
for more information about the syslog information file. This file
"Information Output in the Audit Log Information File"
"Audit
"Syslog