In IBM Spectrum Scale 5.0.5, fileset auditing and skip fileset auditing are available. You can choose up to 20 filesets to apply fileset auditing to, which means that file system activity is only audited if it occurs in the specified filesets. Or, you can choose up to 20 filesets to skip fileset auditing from, which means that all file system events are audited except in the specified filesets. For more information, see Enabling or skipping filesets with file audit logging section in Spectrum Scale document.

The watch API and sample program was for creating a single node watch using the API. Currently, provides more resilient and fully integrated cluster watch with the mmwatch command. It's recommended to use the improved mmwatch command to start clustered watches. For more information, see mmwatch command.

From version 5.0.5, IBM Spectrum Scale will no longer support creating the audit fileset on a filesystem that is not the one being audited. This means that the audit fileset must be belonged to the audited file system.

For more information about changes of File Audit Logging (FAL) and Watch Folder(WF), see Summary of changes in Spectrum Scale 5.0.5.0

Below are some demos and documents about Spectrum Scale File Audit Logging(FAL) and Watch Folder(WF) features and integrated solution with some other productions or services.


[Demo] Bolstering_Cyber_Resilience_Demo
https://ibm.box.com/s/spk5nmovv4rufbper4f5m0wdk4utc0bs

[Redbook] Securing Data on Threat Detection Using IBM Spectrum Scale and IBM QRadar: An Enhanced Cyber Resiliency Solution
http://www.redbooks.ibm.com/abstracts/redp5560.html?Open


[Blog] IBM Spectrum Scale Security Posture with Kibana for Visualization
https://developer.ibm.com/storage/2020/05/22/ibm-spectrum-scale-security-posture-with-kibana-for-visualization/


[Blog] How to Visualize IBM Spectrum Scale Security Posture on Canvas
https://developer.ibm.com/storage/2020/05/22/how-to-visualize-ibm-spectrum-scale-security-posture-on-canvas/


[Blog] Analyze IBM Spectrum Scale File Access Audit with ELK Stack
https://developer.ibm.com/storage/2018/07/30/analyze-ibm-spectrum-scale-file-access-audit-elk-stack/


[Doc] Spectrum Scale File Audit Logging doc portal
https://www.ibm.com/support/knowledgecenter/STXKQY_5.0.5/com.ibm.spectrum.scale.v5r05.doc/bl1ins_quickrefadlg.htm


[Doc] Spectrum Scale Watch Folder API doc portal
https://www.ibm.com/support/knowledgecenter/STXKQY_5.0.5/com.ibm.spectrum.scale.v5r05.doc/bl1ins_quickrefwf.htm


[Doc] Spectrum Scale Clustered Watch Folder doc portal
https://www.ibm.com/support/knowledgecenter/STXKQY_5.0.5/com.ibm.spectrum.scale.v5r05.doc/bl1ins_quickrefclusterw.htm