Skip to content

Commit 7f52f80

Browse files
kcantrelkcantrel
committed
Adding repo move statement.
1 parent 023ad93 commit 7f52f80

File tree

2 files changed

+94
-36
lines changed

2 files changed

+94
-36
lines changed

Monitoring/ingest_nas_audit_logs_into_cloudwatch/README-Manual.md renamed to Monitoring/ingest_nas_audit_logs_into_cloudwatch/README-MANUAL.md

Lines changed: 32 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,12 @@ or by following the manual instructions found in the this file.
1414

1515
## Prerequisites
1616
- An FSx for Data ONTAP file system.
17-
- An S3 bucket to store the "stats" file and a Lambda layer zip file.
18-
- You will need to download the [Lambda layer zip file](https://raw.githubusercontent.com/NetApp/FSx-ONTAP-samples-scripts/main/Monitoring/ingest_nas_audit_logs_into_cloudwatch/lambda_layer.zip) from this repo and upload it to the S3 bucket. Be sure to perserve the name `lambda_layer.zip`.
19-
- The "stats" file is maintained by the program. It is used to keep track of the last time the Lambda function successfully ingested audit logs from each SVM. Its size will be small (i.e. less than a few megabytes).
17+
- An S3 bucket to store the "stats" file and optionally a copy of all the raw NAS audit log files. It will also
18+
hold a Lambda layer file needed to be able to an add Lambda Layer from a CloudFormation script.
19+
- You will need to download the [Lambda layer zip file](https://raw.githubusercontent.com/NetApp/FSx-ONTAP-utils/main/Monitoring/Ingest-NAS-Audit-Logs-into-CloudWatch/lambda_layer.zip)
20+
from this repo and upload it to the S3 bucket. Be sure to preserve the name `lambda_layer.zip`.
21+
- The "stats" file is maintained by the program. It is used to keep track of the last time the Lambda function
22+
successfully ingested audit logs from each SVM. Its size will be small (i.e. less than a few megabytes).
2023
- A CloudWatch log group to ingest the audit logs into. Each audit log file with get its own log stream within the log group.
2124
- Have NAS auditing configured and enabled on the SVM within a FSx for Data ONTAP file system. **Ensure you have selected the XML format for the audit logs.** Also,
2225
ensure you have set up a rotation schedule. The program will only act on audit log files that have been finalized, and not the "active" one. You can read this
@@ -79,7 +82,7 @@ and `DeleteNetworkInterface` actions. The correct resource line is `arn:aws:ec2:
7982
`zip -r ingest_nas_audit_logs.zip .`<br>
8083

8184
2. Within the AWS console, or using the AWS API, create a Lambda function with:
82-
1. Python 3.10, or higher, as the runtime.
85+
1. Python 3.11, or higher, as the runtime.
8386
1. Set the permissions to the role created above.
8487
1. Under `Additional Configurations` select `Enable VPC` and select a VPC and Subnet that will have access to all the FSx for ONTAP
8588
file system management endpoints that you want to gather audit logs from. Also, select a Security Group that allows TCP port 443 outbound.
@@ -90,15 +93,29 @@ process a lot of audit entries and/or process a lot of SVMs.
9093

9194
3. Configure the Lambda function by setting the following environment variables. For a Lambda function you do this by clicking on the `Configuration` tab and then the `Environment variables` sub tab.
9295

93-
| Variable | Description |
94-
| --- | --- |
95-
| fsxRegion | The region where the FSx for ONTAP file systems are located. |
96-
| secretArn | The ARN of the secret that contains the credentials for all the FSx for ONTAP file systems you want to gather audit logs from. |
97-
| s3BucketRegion | The region of the S3 bucket where the stats file is stored. |
98-
| s3BucketName | The name of the S3 bucket where the stats file is stored. |
99-
| statsName | The name you want to use as the stats file. |
100-
| logGroupName | The name of the CloudWatch log group to ingest the audit logs into. |
101-
| volumeName | The name of the volume, on all the FSx for ONTAP file systems, where the audit logs are stored. |
96+
| Variable | Required| Description |
97+
| --- | --- | --- |
98+
| fsxRegion | Yes |The region where the FSx for ONTAP file systems are located. |
99+
| s3BucketRegion |Yes | The region of the S3 bucket where the stats file is stored. |
100+
| s3BucketName | Yes |The name of the S3 bucket where the stats file is stored. |
101+
| copyToS3 | No| Set to `true` if you want to copy the raw audit log files to the S3 bucket.|
102+
|fsxnSecretARNsFile|No|The name of a file within the S3 bucket that contains the Secret ARNs for each for the FSxN file systems. The format of the file should be just `<fsID>=<secretARN>`. For example: `fs-0e8d9172fa5411111=arn:aws:secretsmanager:us-east-1:123456789012:secret:fsxadmin-abc123`|
103+
|fileSystem1ID|No|The ID of the first FSxN file system to ingest the audit logs from.|
104+
|fileSystem1SecretARN|No|The ARN of the secret that contains the credentials for the first FSx for Data ONTAP file system.|
105+
|fileSystem2ID|No|The ID of the second FSx for Data ONTAP file system to ingest the audit logs from.|
106+
|fileSystem2SecretARN|No|The ARN of the secret that contains the credentials for the second FSx for Data ONTAP file system.|
107+
|fileSystem3ID|No|The ID of the third FSx for Data ONTAP file system to ingest the audit logs from.|
108+
|fileSystem3SecretARN|No|The ARN of the secret that contains the credentials for the third FSx for Data ONTAP file system.|
109+
|fileSystem4ID|No|The ID of the forth FSx for Data ONTAP file system to ingest the audit logs from.|
110+
|fileSystem4SecretARN|No|The ARN of the secret that contains the credentials for the forth FSx for Data ONTAP file system.|
111+
|fileSystem5ID|No|The ID of the fifth FSx for Data ONTAP file system to ingest the audit logs from.|
112+
|fileSystem5SecretARN|No|The ARN of the secret that contains the credentials for the fifth FSx for Data ONTAP file system.|
113+
| statsName | Yes| The name you want to use as the stats file. |
114+
| logGroupName | Yes| The name of the CloudWatch log group to ingest the audit logs into. |
115+
| volumeName | Yes| The name of the volume, on all the FSx for ONTAP file systems, where the audit logs are stored. |
116+
117+
**NOTE:** You only need to set the `fsxnSecretARNsFile` or the `fileSystemXID` and `fileSystemXSecretARN` variables.
118+
If both are provide, then the `fsxnSecretARNsFile` will be used and the `fileSystemXID` and `fileSystemXSecretARN` variables will be ignored.
102119

103120
4. Test the Lambda function by clicking on the `Test` tab and then clicking on the `Test` button. You should see "Executing function: succeeded".
104121
If not, click on the "Details" button to see what errors there are.
@@ -110,7 +127,7 @@ set up your FSx for ONTAP file systems to rotate audit logs, and how up-to-date
110127

111128
## Author Information
112129

113-
This repository is maintained by the contributors listed on [GitHub](https://github.com/NetApp/FSx-ONTAP-samples-scripts/graphs/contributors).
130+
This repository is maintained by the contributors listed on [GitHub](https://github.com/NetApp/FSx-ONTAP-utils/graphs/contributors).
114131

115132
## License
116133

@@ -122,4 +139,4 @@ Unless required by applicable law or agreed to in writing, software distributed
122139

123140
See the License for the specific language governing permissions and limitations under the License.
124141

125-
© 2024 NetApp, Inc. All Rights Reserved.
142+
© 2025 NetApp, Inc. All Rights Reserved.

0 commit comments

Comments
 (0)