EMC Isilon server configuration

DataSecurity Plus helps you monitor file and folder events in EMC Isilon servers in real time and provides detailed insights into user operations. It supports OneFS OS version 7.0 and above.

Prerequisites for configuring audit settings in EMC Isilon nodes

This section outlines the steps required to configure audit settings on EMC Isilon nodes so that audit data is forwarded to DataSecurity Plus.

Note: The exact commands depend on your OneFS version.

Step 1: Enable protocol auditing and configure audit settings.

Enable protocol auditing in the target zones and specify the file actions to be recorded using the commands. This ensures that all relevant file activity is captured before forwarding.

Step 2: Enable syslog forwarding.

Enable syslog forwarding from the Isilon nodes using the commands to transmit audit data to DataSecurity Plus to generate file activity reports.

Note: By default, DataSecurity Plus listens for syslog data on port 514.

Step 3: Configure the IP address of the DataSecurity Plus server.

Add the IP address of the DataSecurity Plus collector server to which syslog data should be forwarded.

How to configure EMC Isilon auditing according to your OneFS version

For OneFS version 7.x:

• Run these commands to enable protocol auditing and configure audit settings:
  • isi audit settings modify --protocol-auditing-enabled yes --audited-zones <zone_names>
  • isi zone zones modify <zone_name> --audit-success create,delete,read,rename,set_security,write
  • isi zone zones modify <zone_name> --audit-failure create,delete,read,rename,set_security,write
  • isi zone zones modify <zone_name> --syslog-audit-events create,delete,read,rename,set_security,write
• Run the following command to enable syslog forwarding:
  • isi zone zones modify <zone_name> --syslog-forwarding-enabled=yes
• Follow these steps to configure the IP address of the DataSecurity Plus server:
  • Connect to one of your Isilon nodes using an SSH client.
  • Open the syslog.conf file, located in the /etc/mcp/templates directory.
  • Locate the !audit_protocol line and add the following entry, replacing hostname or IP address with the actual value: *.* @<hostname/IP Address of the DataSecurity Plus server>
  • Save the syslog.conf file.

For OneFS version 8.0 and 8.1:

• Run these commands to enable protocol auditing and configure audit settings:
  • isi audit settings global modify --protocol-auditing-enabled yes --audited-zones <zone_names>
  • isi audit settings modify --zone <zone_name> --audit-success create,delete,read,rename,set_security,write
  • isi audit settings modify --zone <zone_name> --audit-failure create,delete,read,rename,set_security,write
  • isi audit settings modify --zone <zone_name> --syslog-audit-events create,delete,read,rename,set_security,write
• Run the following command to enable syslog forwarding:
  • isi audit settings modify --syslog-forwarding-enabled=yes --zone=<zone_name>
• Follow these steps to configure the IP address of the DataSecurity Plus server:
  • Connect to one of your Isilon nodes using an SSH client.
  • Open the syslog.conf file, located in the /etc/mcp/templates directory.
  • Locate the !audit_protocol line and add the following entry, replacing hostname or IP address with the actual value: *.* @<hostname/IP Address of the DataSecurity Plus server>
  • Save the syslog.conf file.

For OneFS version 8.2 and above:

• Run the following commands to enable protocol auditing, configure audit settings, and specify the IP address of the DataSecurity Plus server:
  • isi audit settings global modify --protocol-auditing-enabled yes --audited-zones <zone_name> --protocol-syslog-servers <IP_of_DataSecurityPlus_server>
  • isi audit settings modify --zone <zone_name> --audit-success create,delete,read,rename,set_security,write
  • isi audit settings modify --zone <zone_name> --audit-failure create,delete,read,rename,set_security,write
  • isi audit settings modify --zone <zone_name> --syslog-audit-events create,delete,read,rename,set_security,write
• Run the following command to enable syslog forwarding:
  • isi audit settings modify --syslog-forwarding-enabled yes --zone <zone_name>

Configuring an Isilon server in DataSecurity Plus

To add an Isilon server for auditing, configure two components: the Isilon cluster and access zone within that cluster.

Step 1: Configuring an Isilon cluster

To configure an Isilon cluster, follow these steps:

• Log in to the DataSecurity Plus web console.
• Select File Audit from the apps drop-down menu.
• Go to Configuration > Data source > EMC Isilon Server.
• On the Configured EMC Isilon page, select an existing Domain from the drop-down menu or configure a new domain using the steps in this help page.
• Once the domain is configured, click +Add Cluster on the Configured EMC Isilon page.
• On the Add Isilon Cluster page, select the Domain Name from the drop-down menu or click Add New Domain to add a new one.
• Select a cluster from the Cluster Name field, enter the cluster credentials, and click Save.

Step 2: Configuring an Isilon zone for the selected cluster

To configure a zone for the selected Isilon cluster, follow these steps:

• On the Configured EMC Isilon page, click Add Zone above the Zone Details section.
• On the Add EMC Isilon Zone page, under the Cluster Name tab, select an Isilon cluster from the drop-down menu and click Next.
• Under the Zone Name tab, choose an EMC Isilon zone to configure and click Next.
• Under the Isilon Shares tab, select one or more shares from the selected zone and click Next.
• Under the Collector Server tab, select the collector server that will gather and process data from the selected shares and click Next.
• Under the Review Summary tab, review the configuration details and click Configure.

Updating Isilon cluster configurations

On the configured EMC Isilon page:

• To update credentials: Click Update credentials link to update the username and password.
• To delete cluster: Click Delete cluster link to remove the configured Isilon cluster.

Updating collector server configurations

To update the collector server configuration, follow these steps:

• On the Configured EMC Isilon page, click Edit configuration under Zone Details. On the Edit Collector prompt, select the Domain Name and Collector Server Name, and click Update.

Adding or removing a share

To add a share:

• On the Configured EMC Isilon page, click Add Shares under the Actions column.
• Select the shares you want to monitor and click Add Shares.

To remove a share:

• On the Configured EMC Isilon page, click Remove Shares under the Actions column.
• Click the delete icon next to the share you want to remove, and click Update.

Troubleshooting EMC Isilon configuration

Potential errors	Cause and resolution
Error: Invalid username or password. Please verify your credentials and try again.	Cause: The SSH credentials provided for the Isilon cluster are incorrect, or the account has been modified. To resolve: Verify the username and password by logging into the Isilon cluster directly via SSH (e.g., using PuTTY to connect to the cluster on port 22). Ensure the Isilon user account is not locked, disabled, or expired. Ensure password based SSH authentication is enabled on the Isilon cluster.
Error: Connection error: Check network and SSH port. Contact support if the issue persists.	Cause: The DataSecurity Plus server cannot reach the Isilon cluster over the network using SSH via port 22. To resolve: Ping the Isilon cluster's hostname or IP address from the DataSecurity Plus server to verify network connectivity. Test SSH port access by running telnet <cluster_IP> 22.
Issue : The Isilon cluster is not listed in the Cluster Name drop-down menu.	Cause: The cluster is not detected if its Active Directory computer object does not have the OS set to OneFS, or if the cluster is not joined to the selected domain. To resolve: Verify the Isilon cluster is joined to the selected Active Directory domain. In Active Directory, confirm the computer object for the Isilon cluster has the OS attribute set to OneFS. Go to Domain Settings and refresh the domain that contains the cluster. After the refresh completes, retry the configuration.
Error: Zones unavailable for the selected cluster.	Cause: Zone discovery failed due to insufficient SSH permissions, an unsupported OneFS version , or a domain mismatch between the zone's Active Directory provider and the domain configured in DataSecurity Plus. To resolve: Ensure the configured Isilon user has permission to run isi CLI commands on the cluster. Verify the Isilon cluster is running a supported OneFS version (7.x, 8.x, or 9.x). Confirm each access zone on the cluster has an Active Directory authentication provider, and that its domain matches the domain selected in DataSecurity Plus.
Error: Error in getting shares. The network path was not found - Error code: 35	Cause: The SMB shares in the zone are not accessible from the DataSecurity Plus server. To resolve: Ensure the user configured under Domain Settings has permission to read the shares in the configured zone. If the issue persists, add host entries on the server running DataSecurity Plus to resolve DNS issues. Ensure the ports used to access SMB shares are open.
Error: Port 514 is unavailable on the collector server; ensure it's open and ready to receive data.	Cause: Another application is already using UDP port 514 on the collector server, or a firewall is blocking it. To resolve: Run netstat -ano | findstr :514 to check whether the port is in use. If another application is using the port, stop it or reconfigure it to use a different port. Ensure the Windows firewall and any security software allow inbound UDP traffic on port 514. Restart the DataSecurity Plus collector agent service after freeing port 514.
Issue: No audit data received/Reports show "No Data Available"	Cause: Either syslog events from the Isilon cluster are not reaching the collector agent, or the cluster's audit configuration is incomplete. To resolve: Verify collector status: Log in to the DataSecurity Plus web console, navigate to File Audit > Configuration > EMC Isilon Server > Configured EMC Isilon and confirm that the agent status is up and running. Check network path: Confirm that UDP port 514 is reachable from each Isilon node to the collector server. Firewalls or NAT may block syslog traffic. Test syslog manually: Install a free syslog receiver (e.g., ManageEngine Free Syslog Forwarder) on the collector, stop the DataSecurity Plus collector agent, and check whether syslog data arrives. If no data is received, the issue is on the Isilon syslog or network side. Verify Isilon audit settings: On the OneFS console, confirm protocol auditing is enabled for the configured access zone and that the relevant events (i.e., create, delete, rename) are included. Verify syslog forwarding is configured on the Isilon cluster and pointed at the collector server's IP address on UDP port 514.
Error: No zone addition is allowed as license limit has reached.	Cause: The maximum number of NAS servers allowed by your current license has been reached. To resolve: Check your current license usage in the DataSecurity Plus license settings. Remove any unused or decommissioned NAS server entries to free up license slots. If the issue persist, contact your ManageEngine account manager or email support@datasecurityplus.com to upgrade your license if you need more servers slots.