6.7 Configuring Dell EMC Monitoring

Change Guardian monitors Dell EMC file systems on Isilon and Unity storage platforms.

This section provides the following information:

The following diagram illustrates how Change Guardian collects events from Dell EMC:

Figure 6-2 Dell EMC Monitoring using Change Guardian

The deployment diagram illustrates the following:

  • Dell EMC Comment Event Enabler (CEE) collects events from the Dell EMC machine. For more information about Dell EMC CEE, see Using the Common Event Enabler for Windows in the Dell EMC website.

  • Change Guardian Event Collector Addon for Windows Agent acts as the interface between Dell EMC and Change Guardian. Change Guardian Event Collector Addon for Windows Agent pulls change event data from Dell EMC CEE and stores the event details in a CEF log file.

  • Change Guardian Agent for Windows reads from the CEF log file and sends the event details to the Change Guardian server.

6.7.1 Implementation Checklist

Complete the following tasks to start monitoring Dell EMC events:

Task

See

Complete the prerequisites

Prerequisites

Add a license key

Adding License for Applications

Configure Change Guardian for Dell EMC monitoring

Configuring Change Guardian for Monitoring

Categories of Change Guardian Policies for Dell EMC

Assigning Policies and Policy Sets

Triage events

Section 7.0, Configuring Events

Section 9.0, Configuring Alerts

6.7.2 Prerequisites

Ensure that you have completed the following:

6.7.3 Configuring Change Guardian for Monitoring

You must configure the Change Guardian server to receive Dell EMC event logs from Change Guardian Event Collector Addon for Windows Agent.

Enabling Dell EMC Monitoring

Ensure that you have added Dell EMC assets using Agent Manager.

To enable monitoring:

  1. In Agent Manager, select the asset and click Manage Installations > Install Agents.

    Or

    In Agent Manager, select the asset and click Manage Installations > Reconfigure Agents.

  2. In the Reconfigure Agent page, select Enable Collector Plugin under Edit Agent Configuration.

  3. Specify the location to store CEF events in CEF Data Output Path.

    NOTE:Ensure that the value in CEF Data Output Path matches the CEF data path you specify during Change Guardian Event Collector Addon for Windows Agent installation. You can get the CEF data path from the ceffolder parameter in <install_directory>\current\user\agent\agent.properties.

6.7.4 Categories of Change Guardian Policies for Dell EMC

You can create file system policies to generate events about files and directories when they are created, deleted, renamed, permission changed, and so on.

For information about creating policies, see Creating Policies.

While creating file system policies, specify the EMC shared path in the following format: \\hostname\device type identifier\local sub folder.

For example,

  • For Isilon, specify \\onefs8104-1\onefs$\ifs\<local sub directory>

  • for Unity, specify \\onefs8104-1\CHECK$\ifs\<local sub directory>

Here, \\onefs8104-1 is the hostname and \ifs\<local sub directory> is the directory you want to monitor.

NOTE:You must monitor the file system of Dell EMC Unity storage. For example, specify the path as \\Unity-1\CHECK$\LocalFS in Policy Editor, where LocalFS is the Dell EMC Unity file system name.

After creating policies, you can assign them to assets. For information about assigning policies, see Working with Policies.