XorMon can present IBM FlashSystem audit and security logs.

Audit log example

2026-08-22T16:54:01+00:00 Storwize02 IBM4680[13437]: # timestamp = Sat Aug 22 16:54:01 2026 # cluster_user = superuser # source_panel = 01-2 # target_panel = 01-1 # ssh_ip_address = 192.168.111.157 # result = success # res_obj_id = none # command = satask # action = snap # action_cmd = snap 01-1  # duration_ms = 13
2026-08-22T16:54:31+00:00 Storwize02 IBM4680[13437]: # timestamp = Sat Aug 22 16:54:31 2026 # cluster_user = superuser # source_panel = 01-2 # target_panel = 01-2 # ssh_ip_address = 192.168.111.157 # result = success # res_obj_id = none # command = satask # action = cpfiles # action_cmd = cpfiles -prefix /dumps/snap.single.7813MD4-1.260822.165402.tgz -source 01-1  # duration_ms = 0
2026-08-22T17:45:23+00:00 Storwize02 IBM4680[13437]: # timestamp = Sat Aug 22 17:45:23 2026 # cluster_user = superuser # source_panel =  # target_panel =  # ssh_ip_address = 192.168.111.157 # result = success # res_obj_id = none # command = svctask # action = chsyslogserver # action_cmd = chsyslogserver -warning on -info on 0 # duration_ms = 4

Security log example

2026-08-24T11:46:34+00:00 Storwize02 sshd[1773494]: pam_ec_auth(sshd:auth): Username xormon has linux user group: 1002
2026-08-24T11:46:34+00:00 Storwize02 sshd[1773494]: pam_ec_auth(sshd:auth): Accepted password for xormon from 192.168.111.145 service sshd
2026-08-24T11:46:34+00:00 Storwize02 sshd[1773491]: Accepted keyboard-interactive/pam for xormon from 192.168.111.145 port 54026 ssh2
2026-08-24T11:46:35+00:00 Storwize02 sshd[1773491]: pam_unix(sshd:session): session opened for user xormon(uid=1002) by admin(uid=0)
2026-08-24T11:46:38+00:00 Storwize02 sshd[1773507]: Received disconnect from 192.168.111.145 port 54026:11: disconnected by user
2026-08-24T11:46:38+00:00 Storwize02 sshd[1773507]: Disconnected from user xormon 192.168.111.145 port 54026
2026-08-24T11:46:38+00:00 Storwize02 sshd[1773491]: pam_unix(sshd:session): session closed for user xormon