Storing Audit Logs - HP XP20000/XP24000 Reference Manual

10. Confirm that the syslog server is receiving the log of syslog server setting when the setting
operation is completed. AuditLog is the function name of the log and Set Syslog Server is the
operation name (see
If the log is not received by the syslog server, verify that the IP address and the port number
set matches with the IP address and the port number of the syslog server. If the IP address and
the port number matches, check the syslog server setting. See the users manual of the syslog
server for more details on syslog server settings.
Figure 2 Syslog Window

Storing Audit Logs

To store audit logs, you can either to temporarily store audit logs in a system disk before storing
the logs in the SVP, or store audit logs directly in the SVP. To keep track of commands sent from
hosts, HP recommends that you temporarily store audit logs in a system disk before storing the logs
in the SVP.
Audit logs are transferred and stored in the SVP. However, audit logs might get lost if the SVP is
not working due to a failure, because the SVP cannot receive the transferred audit logs. You can
temporarily store logs in a system disk so that you can reduce the risk of losing audit logs. The
audit logs stored in the system disk will be eventually stored in the SVP.
Only the storage administrator can configure how to store audit logs, and the Audit Log
Administrator Role needs to be set to Modify. Make sure that the storage administrator has created
a system disk to store audit logs temporarily before storing the logs in the SVP.
To configure how to store audit logs:
1. Log on as a storage administrator and open the Remote Web Console main window.
2. Change to Modify mode.
3. Click Go – Security – Audit Log Setting in the menu bar of the Remote Web Console main
window. The Audit Log Setting window (see
"Set Syslog Server Operation" (page 45)).
Figure 3 (page 18)) displays.
Storing Audit Logs 17