Starting with PowerStoreOS 3.0, Common Event Publishing Agent (CEPA) is available. CEPA delivers SMB and NFS file and directory event notifications to a server, enabling them to be parsed and controlled by third-party applications. This can be used for use cases such as detecting ransomware, managing user access, configuring quotas, and providing storage analytics. The event notification solution consists of a combination of the PowerStore, Common Event Enabler (CEE) CEPA software, and a third-party application.

CEPA includes the following facilities that can be leveraged by third-party applications:

• Auditing—Enables file auditing for operations such as create, open, delete, close, rename, and ACL updates
• Centralized Quota Management (CQM)—Enables managing quotas across multiple storage systems
• VCAPS—Notifies search and indexing appliances when it is time to re-scan files

Publishing Pools

To configure CEPA, create a Publishing Pool and Events Publisher at Storage > NAS Servers > NAS Settings page in PowerStore Manager. The publishing pool specifies which events should trigger notifications and to which servers they should be sent. There can be up to five CEPA servers, which can be specified by IPv4 address, IPv6 address, or FQDN. The available events fall under three categories:

• Pre-Events—When an operation is requested, the NAS server sends a notification and waits for approval before allowing the operation to occur
• Post-Events—NAS server sends a notification after an operation occurs
• Post-Error-Events—NAS server sends a notification if an operation generates an error

Figure 48 shows the publishing pool configuration page.

Figure 48.    Publishing pool configuration

Events publisher

The events publisher specifies one to three publishing pools and enables configuration of advanced settings.

• Pre-Events Failure Policy—Determines the pre-event behavior if PowerStore cannot reach CEPA Server

• Ignore (default)—Consider pre-events acknowledged when CEPA servers are offline
• Deny—Deny user access when a corresponding pre-event request to CEPA servers failed

• Post-Events Failure Policy—Determines the post-event behavior if PowerStore cannot reach CEPA Server

• Ignore—Continue and tolerate lost events
• Accumulate (default)—Continue and persist lost events in an internal buffer
• Guarantee—Persist lost events, deny file systems access when the buffer is full
• Deny—Deny access to file systems when CEPA servers are offline

• Connectivity and protocol settings

• HTTP and Port—HTTP and 12228, by default
• Microsoft RPC and Accounts—Enabled and SMB, by default
• Heartbeat and Timeout—10 sec and 1000 ms, by default

Figure 49 shows the events publisher configuration page.

Figure 49.    Events publisher configuration

Enabling events publishing

When an events publisher is created, events publishing can be enabled on a NAS server. Multiple NAS servers can use the same events publisher. You can enable events publishing at NAS server properties > Security & Events > Events Publishing. When enabling events publishing, there is also an option to Enable for all existing file systems under the NAS server for SMB and NFS, as shown in Figure 50.

Figure 50.    Enabling events publisher on a NAS server

A NAS server can contain a mix of file systems with and without events publishing enabled. When events publishing is enabled on the NAS server, it can be enabled or disabled on each individual file system at Storage > File Systems > file system properties > Security & Events, as shown in Figure 51.

Figure 51.    Events publishing on a file system

For a list of supported third-party applications or for more information about how to configure CEPA, see Dell PowerStore Simple Support Matrix, Dell PowerStore Configuring SMB, and Dell PowerStore Configuring NFS on Dell.com/powerstoredocs.