What if activities are not collected by the Activity Monitor

  1. If activities are not collected by the Activity Monitor, the status of the components should be tracked, from the Isilon OneFS to the Activity Monitor service.
  2. Log in to the OneFS as an administrative user.

  3. Type the following command to display the audit events stored on the Isilon:

    isi_audit_viewer -t protocol

    Isilon is properly configured for auditing if the command results in a display of events. Check all the CEE and Activity Monitor configurations described above.

  4. Run the following command:

    isi audit settings view
  5. Verify that the CEE URL is correct, and that the host name configured matches the host name configured in the Application configuration.
  6. Verify that the CEE server is accessible in the configured port from the Isilon by pinging it, and running telnet to the configured port.

  7. Run the following command:

    isi zone zones view [Zone Name]
  8. Make sure the Zone is configured for all event types to be monitored.

Advanced troubleshooting:

  1. The file /var/log/isi_audit_cee.log on the Isilon contains the internal audit_cee process log. Use the “cat” command to view its contents.

  2. If no content is displayed, raise the debugging level of the process by running the following command:

    isi_ilog --level debug+ --application isi_audit_cee

  3. To make the process change log levels, make a change to the audit configuration in order to see the log line.

    The following lines indicate a problem with the CEE connection:

    1. 2014-02-20 12:49:17 vwjaws2-1 isi_audit_cee[65098][0x800d020b0]: DEBUG: deliver_event: No CEE servers available.
    2. 2014-02-20 12:49:17 vwjaws2-1 isi_audit_cee[65098][0x800d05da0]: DEBUG: heartbeater: available servers: []
  4. When finished, lower the log level to info.
  5. If none of the above helps, we can use a tool called DebugView (Part of Windows Sysinternals) to help us see debug messages from the CEE:
    1. Download DebugView (https://technet.microsoft.com/en-us/sysinternals/debugview.aspx).
    2. Extract to an accessible folder on the CEE server.
    3. Run Dbgview.exe.