For Audit, OneFS has an audit queue service (isi_audit_d) which handles the writing and rotating of logs in /ifs/.ifsvar/audit/logs For forwarding to CEE (isi_audit_cee), the workflow is1. Get the next item from the queue, and encode it into the required CEEformat.2. Check Heartbeat of CEE server3. Forward the event to CEE via HTTP4. Receive notification that the event was successfully received in HTTPresponse codes5. The CEE Server forwards the event to the defined endpoint6. Update the pointer to the next record in the audit logs
I'm running Isilon 7.2 using CEE and I'm trying to determine the flow of audit events through the system.  1. Event is triggered by User 2. isilon records event in /ifs/.ifsvar/logs 3. isi_audit_cee (or isi_audit_d) forwards those events to CEPA (running on windows server in my case) 4. Does isilon get a response back at this point from CEPA that the event has been received? 5. Audit event is forwarded to 3rd party tool from CEPA server 6. Is third party tool required to say that the event has been received?  I can't tell in this process if there's a gap such that if one part is down, you lose audit events. What happens if CEPA is down, will Isilon resend those events? Does CEPA queue events if the 3rd party tool has not responded to a passed event?  Thanks, Greg
CEE with Isilon 7.2 and Event Flow