Troubleshooting
Check the issues below for common problems and suggested ways of handling them.
What if activities are not collected by the Activity Monitor
-
If activities are not collected by the Activity Monitor, the status of the components should be tracked, from the Isilon OneFS to the Activity Monitor service.
-
Log in to the OneFS as an administrative user.
-
Type the following command to display the audit events stored on the Isilon:
isi_audit_viewer -t protocol
Isilon is properly configured for auditing if the command results in a display of events. Check all the CEE and Activity Monitor configurations described above.
-
Run the following command:
isi audit settings view
-
Verify that the CEE URL is correct, and that the host name configured matches the host name configured in the Application configuration.
-
Verify that the CEE server is accessible in the configured port from the Isilon by pinging it, and running telnet to the configured port.
-
Run the following command:
isi zone zones view [Zone Name]
-
Make sure the Zone is configured for all event types to be monitored.
Advanced troubleshooting
-
The file
/var/log/isi_audit_cee.log
on the Isilon contains the internal audit_cee process log. Use thecat
command to view its contents. -
If no content is displayed, raise the debugging level of the process by running the following command:
isi_ilog --level debug+ --application isi_audit_cee
-
To make the process change log levels, make a change to the audit configuration in order to view the log line.
The following lines indicate a problem with the CEE connection:
-
2014-02-20 12:49:17 vwjaws2-1 isi_audit_cee[65098][0x800d020b0]: DEBUG: deliver_event: No CEE servers available.
-
2014-02-20 12:49:17 vwjaws2-1 isi_audit_cee[65098][0x800d05da0]: DEBUG: heartbeater: available servers: []
-
-
When finished, lower the log level to info.
-
If none of the above helps, we can use a tool called DebugView (Part of Windows Sysinternals) to help us view debug messages from the CEE:
-
Download DebugView.
-
Extract to an accessible folder on the CEE server.
-
Run
Dbgview.exe
.
-