Hey docmikewoods,  I think you may be in the wrong section as this is the Isilon forum so you may have to move to VNX side for that specifically if that is really the product you need this answered to but if not on Isilon the only real way we would know what a user did is by using protocols audit logging best used with a third party tool like veronis.  we configure syslog to forward the desired events that are tracked i.e. move, delete, open, close to the veronis where it makes the output in a slightly more human readable format. That being said for everything you track on Isilon it has the need for an additonal write to the cluster to track that action so busy workflows can be negatively impacted by this.  hope that helps at least for the Isilon side of things.  D_Tracy
Every time an employee is let go, my department is asked what that user did on their last days. It sounds like all they want is a clean report that states what a user did on our VNX in their last few days at the company. What is the easiest way to get this done?
Best way to report on user activity