Rules (XIF)
[MODEL: dataset="ibm_storagescale_raw"]
alter
// Map to XDM fields - direct mappings
xdm.event.original_event_type = "CLI Audit Logs", // Integration API Endpoint - https://www.ibm.com/docs/en/storage-scale/5.2.2?topic=endpoints-cliauditlog-get
xdm.source.process.name = command,
xdm.source.process.command_line = arguments,
xdm.source.host.hostname = node,
xdm.observer.type = originator,
xdm.source.process.pid = to_integer(pid),
// Conditional mappings
xdm.auth.privilege_level = if(
user = "root", XDM_CONST.PRIVILEGE_LEVEL_SYSTEM,
null),
xdm.event.type = if( // Check the Event Type based on command.
command in ("mmcrnodeclass","mmchlicense","mmaddnode", "mmchcluster", "mmchconfig", "mmchnode", "mmcrcluster", "mmdelnode", "mmgetstate", "mmshutdown","mmstartup"),"Cluster Management",
command in ("mmadddisk","mmchdisk","mmcrfs","mmdelfs","mmlsfs","mmmount","mmumount","mmrpldisk"),"File System Management",
command in ("mmcrfileset","mmlsfileset","mmcrsnapshot","mmdelsnapshot","mmlssnapshot"),"Fileset & Snapshots",
command in ("mmapplypolicy","mmchpolicy","mmlspolicy"),"ILM & Policy",
command in ("mmhealth","mmperfmon","gpfs.snap","mmnetverify","mmchqos","mmcheckquota"),"Monitoring & Health",
command in ("mmces","mmnfs","mmsmb","mms3"), "Protocols (CES)",
command in ("mmafmconfig","mmafmctl"),"AFM",
command in ("mmgetacl","mmputacl","mmauth","mmkeyserv"), "Security",
command in ("mmaddcallback"), "Cluster Automation",
command in ("mmguiadm","mmadviser"), "GUI & Management",
command in ("mmcallhome"), "Support",
command in ("mmcloudgateway","mmcloudaccount"),"Cloud Tiering",
command in ("mmlsnsd","mmcrnsd","mmdelnsd"),"Disk Management",
command in ("mmchnodecanary"),"Network",
command in ("mmdiag","mmfsadm","mmfsck"), "Diagnostics",
command in ("mmbackup","mmrestore","mmxcp"), "Backup",
command in ("mmcsi"),"Container Integration",
command in ("mmmsgqueue"),"Auditing",
"Other"),
xdm.event.outcome = if( // Check weather the outcome is success or failure.
to_integer(returnCode) = 0, XDM_CONST.OUTCOME_SUCCESS,
XDM_CONST.OUTCOME_FAILED
),
xdm.source.user.username = if( // Check if the user field is equal to null, empty string or unknown.
user in ("null", "unknown", ""), null,
user),
// Commands Description https://www.ibm.com/docs/en/storage-scale/5.2.3?topic=command-reference - Based on IBM Documentation
xdm.event.description = if(
command = "mmaddnode", "Adds one or more nodes to the IBM Storage Scale cluster.",
command = "mmchcluster", "Changes the configuration of the cluster (e.g. name or primary server).",
command = "mmchconfig", "Updates GPFS daemon configuration parameters (e.g. pagepool size).",
command = "mmchnode", "Modifies node-specific attributes such as quorum status or manager roles.",
command = "mmcrcluster", "Creates a new IBM Storage Scale cluster.",
command = "mmdelnode", "Removes nodes from the cluster configuration.",
command = "mmgetstate", "Displays the current state of the GPFS daemon on nodes.",
command = "mmshutdown", "Stops the IBM Storage Scale (GPFS) services on specified nodes.",
command = "mmstartup", "Starts the IBM Storage Scale (GPFS) services on specified nodes.",
command = "mmadddisk", "Adds new disks (NSDs) to an existing file system.",
command = "mmchdisk", "Changes the state of a disk (e.g. suspending or starting it).",
command = "mmcrfs", "Creates an IBM Storage Scale file system on a set of disks.",
command = "mmdelfs", "Deletes a file system and its associated metadata.",
command = "mmlsfs", "Lists the configuration attributes of a specific file system.",
command = "mmmount", "Mounts a file system on one or more nodes.",
command = "mmumount", "Unmounts a file system on one or more nodes.",
command = "mmrpldisk", "Replaces a physical disk that has failed or is being retired.",
command = "mmcrfileset", "Creates a fileset (logical partition within a file system).",
command = "mmlsfileset", "Lists existing filesets and their current statuses.",
command = "mmcrsnapshot", "Creates a point-in-time snapshot of a file system or fileset.",
command = "mmdelsnapshot", "Deletes a previously created snapshot.",
command = "mmlssnapshot", "Lists the snapshots available for a file system.",
command = "mmapplypolicy", "Executes policy rules to migrate or delete data based on criteria.",
command = "mmchpolicy", "Installs or changes the active data management policy.",
command = "mmlspolicy", "Displays the current active policy rules for a file system.",
command = "mmhealth", "Displays the health status of nodes and storage services.",
command = "mmperfmon", "Configures and queries the performance monitoring sensors.",
command = "gpfs.snap", "Collects logs and configuration data for IBM support.",
command = "mmnetverify", "Verifies network connectivity and performance between nodes.",
command = "mmces", "Manages Clustered Export Services (NFS/SMB/S3) node assignments.",
command = "mmnfs", "Configures and manages NFS exports.",
command = "mmsmb", "Configures and manages SMB shares and user access.",
command = "mms3", "Manages S3 protocol services including buckets and accounts.",
command = "mmafmconfig", "Configures Active File Management (AFM) settings for a fileset.",
command = "mmafmctl", "Controls AFM synchronization and failover operations.",
command = "mmauth", "Manages authorization for remote cluster access.",
command = "mmkeyserv", "Manages connections to external key servers for encryption.",
command = "mmaddcallback", "Registers user-defined scripts to be triggered by specific cluster events.",
command = "mmguiadm", "Manages the IBM Storage Scale GUI services and configuration.",
command = "mmadviser", "Provides performance and configuration recommendations.",
command = "mmcallhome", "Configures automated hardware and software problem reporting to IBM.",
command = "mmcloudgateway", "Manages the Transparent Cloud Tiering gateway for object storage integration.",
command = "mmcloudaccount", "Manages cloud storage credentials and account configurations.",
command = "mmcrnsd", "Creates Network Shared Disks (NSDs) from physical LUNs.",
command = "mmdelnsd", "Deletes Network Shared Disk (NSD) definitions.",
command = "mmchnodecanary", "Configures the node canary for detecting network partitions.",
command = "mmfsck", "Checks and repairs file system consistency (Offline or Online).",
command = "mmbackup", "Performs parallel backups to IBM Storage Protect servers.",
command = "mmrestore", "Restores file system data from IBM Storage Protect backups.",
command = "mmxcp", "High-performance parallel copy tool for large data migrations.",
command = "mmlsnsd", "Lists all NSDs and their connectivity across the cluster.",
command = "mmchqos", "Sets I/O performance limits (QoS) for file systems or filesets.",
command = "mmcheckquota", "Checks and updates user/group/fileset quota usage.",
command = "mmdiag", "Queries the GPFS daemon for internal state and wait diagnostics.",
command = "mmfsadm", "Low-level management tool for daemon dumps and debugging.",
command = "mmgetacl", "Displays the Access Control List (ACL) for a file or directory.",
command = "mmputacl", "Sets or modifies the Access Control List (ACL) for a file or directory.",
command = "mmcsi", "Manages the Container Storage Interface for Kubernetes/OpenShift.",
command = "mmcrnodeclass", "Creates user-defined node classes to group nodes for easier management.",
command = "mmchlicense", "Changes and accepts the IBM Storage Scale license type for cluster nodes.",
command = "mmmsgqueue", "Configures the message queue used for File Audit Logging and Watch Folders.",
null);