Security Compliance

Integrate NetApp or EMC SAN with SolarWinds SEM

This article describes integrating SolarWinds SEM with NetApp to audit files. These steps also apply to EMC SAN.

First published date

10/10/2018 1:59 AM

Last published date

5/26/2021 9:44 PM

Overview

This article provides steps on integrating SolarWinds Security Event Manager (formerly Log & Event Manager) with NetApp to audit files. These steps also apply to EMC SAN.

Requirements
Integration configuration requires the following components:

  • NetApp with CIFS auditing turned on and an administrator account for monitoring
  • A Windows machine that has:
    • The NetApp administrator account with local administrator privileges
    • The SEM agent with the service setup to log on with the NetApp administrator account
  • The connector installed and configured on the manager

Product section

Security Event Manager

Cause

N/A

Resolution

Note: NetApp cannot be in cluster mode. It must be in 7 mode.
If you are interested in monitoring Cluster mode, please create a feature request with SolarWinds Support or via the THWACK forum.

Enable CIFS 

For the NetApp OnTAP hardware or simulator, you must have CIFS enabled and running. In OnTAP, enter the following command to enable all CIFS auditing:

options cifs.audit.liveview.enable on cifs audit start


To audit only selected portions of CIFS, please refer to Configuring Data OnTAP for CIFS Auditing (© 2016 NetApp, available at https://library.netapp.com, obtained on April 25, 2018.) on the NetApp website.
 

Configure the NetApp user with administrator rights 

  1. On the Windows machine monitoring NetApp, navigate to Control Panel > Administrative Tools > Services.
    1. Open the SolarWinds Security Event Manager Agent service properties.
    2. On the Log On tab, select This account, and then enter the username and password of the NetApp user.
    3. Click OK and restart the service.
  2. Add that same user to the Windows machine that will be monitoring NetApp. This user also needs local administrator rights on the Windows machine.

Install the connector on an agent 

  1. On the SEM console toolbar, navigate to Manage > Nodes.
  2. Find and select the agent node that will monitor NetApp:
    1. Next to the agent node, click the gear icon, and then select Connectors.
    2. In the Refine Results search box, type netapp to find the connector. 
  3. Next to the connector, click the gear icon, and then select New.
  4. In the Computer UNC field, enter the path to the NetApp machine. The UNC should be \\hostname or \\ipaddress with nothing after it.
  5. Save the connector configuration.
  6. Next to the connector, click the gear icon, and then select Start.