Dell PowerFlex Appliance with PowerFlex 4.x Administration Guide

Configure audit logs in SVMs and PowerFlex storage-only nodes

Use this procedure to configure and maintain audit logs of a user in a separate file commands.log in SVMs and PowerFlex storage-only nodes and transmit them to the remote servers.

1. Log in to each SVM or PowerFlex storage-only node using SSH.
2. Run the following commands to record all the commands executed by the users:
   1. Edit the system-wide BASH runtime configuration file:
      #sudo -e /etc/bash.bashrc
   2. Append the following to the end of the file:
      export PROMPT_COMMAND='RETRN_VAL=$?;logger -p security.debug "$(whoami) [$$]: $(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//" ) [$RETRN_VAL]"'
   3. Press Esc+:wq to save the file.
   4. To setup the audit logging for local6 with a new file as commands.log, run the following command to edit the remote syslog BASH runtime configuration file:
      # sudo -e /etc/rsyslog.d/bash.conf
   5. Enter the following:
      security.* /var/log/commands
   6. Press Esc+:wq to save the file.
3. To forward the audit log file /var/log/audit/audit.log to the remote syslog server, edit /etc/audit/plugins.d/syslog.conf and do the following:
   1. Set active=yes
   2. Append security in args:
   For example:

   #vi /etc/audit/plugins.d/syslog.conf  
   active = yes  # changes made from No to Yes
   direction = out
   path = /sbin/audisp-syslog
   type = always
   args = LOG_INFO LOG_security  # append security to write the audit logs to remote server
   format = string

4. To transmit the logs to the remote server:
   1. Edit the rsyslog.conf file:
      # vi /etc/rsyslog.conf
   2. Add the following lines to route the logs to the remote server:

      $ModLoad imfile
      $InputFileName /var/log/audit/audit.log
      $InputFileTag tag_audit_log:
      $InputFileStateFile audit_log
      $InputFileSeverity info
      $InputRunFileMonitor
      local6.* @<remoteserverIP>:514  #Remote server IP address to be updated

      In PowerFlex Manager, both TCP and UDP connections are supported and port number 514 is used for the syslog transfer.
5. Restart the remote syslog service:
   systemctl restart rsyslog.service
6. To manage the log file /etc/logrotate.conf:
   1. To edit the file, type # vi /etc/logrotate.conf.
   2. Update the following lines:

      ## AUDIT LOG###
      /var/log/commands {
      compress
      dateext
      maxage 14
      rotate 2
      missingok
      notifempty
      size +4096k
      } 

   3. Type :wq to save the file.