User Behavior Auditing and Analysis

User Behavior Auditing allows you to track how end users interact with data stored on your system. User Behavior logs the operations for each file made by applications and users, such as file creation, movement, deletions, and so on. BrickStor displays this information in real-time reports and graphs.

You can enable User Behavior at the pool level or the dataset level. BrickStor logs the behavior of users at the system level where it was configured and its descendants. For example, if you enable User Behavior at the Pool Level, it is also enabled for all datasets within that pool.

By default, the system stores user behavior data in the meta dataset of the pool.

Enabling User Behavior

To enable User Behavior, complete the following steps:

  1. In BrickStor SP Manager, select either a pool or dataset.

  2. In the Details pane, select the Settings tab.

  3. Under User Behavior, click the toggle button to On.

    ub enable user behavior

  4. In the Changes pane, click Commit Changes.

    ub enable user behavior commit

User Behavior Audit

After you enable User Behavior, BrickStor displays an overview of all user actions initiated from that point. You can view the following information in the User Behavior Audit.

Accessing the User Behavior Audit

To view the User Behavior Audit, complete the following steps:

  1. In the Connections pane, select either a pool or dataset.

  2. In the Details pane, select the User Behavior tab.

    ub user behavior audit

    Most of the content here can be clicked on and will lead to the Activity page.

Forwarding User Behavior

The user behavior activity can be forwarded to a SIEM or log centralization for off system processing and analysis. To configure UBA to forward to another host edit the configuration file in /etc/racktop/ubcollectd/ubcollectd.conf [Syslog] Protocol = "udp" Server = "10.1.29.X:514" CertFile = "" Facility = "local0" Enabled = true