NetApp Audit Logs Reaching Lepide with Significant Delay

Issue Description

NetApp audit logs are reaching the Lepide Data Security Platform with a significant delay. The audit events are not being processed in real-time, causing a delay in report updates and log availability.

Cause

During investigation, it was identified that a single user generated approximately 4 million audit records within a short period of time.

Due to the large volume of events:

• Audit logs accumulated in the processing queue.

• Log processing became slower.

• The delay occurred while Lepide was processing the excessive number of records.

Resolution

The following actions were performed to resolve the issue:

• Cleaned up the corrupted/accumulated audit data

  • Removed the problematic data that was causing delays in processing.

• Added the backup user to the exclusion list

  • The user generating a large number of unnecessary audit records was identified as a backup-related account.

  • Added this user to the exclusion list to prevent similar excessive audit generation in the future.

Verification

After performing the cleanup and adding the exclusion:

• NetApp audit logs started reaching Lepide without significant delay.

• Log processing performance returned to normal.

Recommendation

Review high-volume service accounts (such as backup accounts, scanning accounts, or automated processes) and add appropriate exclusions if they generate large volumes of audit events that are not required for monitoring.