Security logs from EMC Celerra

[zafunt]

Does anyone have experience reading security logs from an EMC Celerra?

Our storage people are able to export a "live" file in an EVT format. However, Windows is unable to open it up. I can, however, use the "connect to computer" from a windows box to the datamover, and I can see the log. It just doesn't work from this export.

[halr9000]

You should be able to use the Common Event Enabler (intro blog post), which is a piece of free middleware from EMC that gathers file events from VNX (probably Celerra, Internet says yes), and Isilon, and notifies subscribers of those events in a managed way. It's often used for antivirus products, but is also used for audit use cases.

Long story short, watch this page ( http://apps.splunk.com/apps/#/search/vnx ), an app should appear there shortly, it was submitted the other day.

[dmaislin_splunk]

Yep, I uploaded it yesterday, am an awaiting approval. There will be 2 components, the add on that has communicates with EMC CEE API, and the app which contains all the lookup tables, field extractions, etc.