Local Array Limitations: The FlashArray GUI and CLI maintain a local buffer for audit logs (which track commands, logins, and configuration changes). However, this local storage is limited in size and record count (typically around 1000 records or a short timeframe) to ensure that logging does not consume excessive system resources on the controllers. Once the limit is reached, older records are overwritten (FIFO - First In, First Out).
Pure1 as the Historical Repository: Pure1 is Pure Storage's cloud-based management and monitoring platform. One of its primary functions is to act as a long-term repository for array data. FlashArrays "phone home" their audit logs to Pure1, where they are indexed and stored for much longer periods (typically up to one year or more, depending on the subscription level).
Auditing in Pure1: By logging into the Pure1 portal, an administrator can navigate to the Audits section. Unlike the local GUI, Pure1 allows users to filter by specific date ranges, specific arrays, and specific users across the entire fleet. This makes it the standard tool for security audits and compliance reporting.
Why Option A and C are incorrect: * Option A: While the CLI is powerful, it still pulls from the same limited local buffer as the GUI. If the record has been overwritten locally, the CLI cannot retrieve it.
Option C: Purity does not typically allow customers to modify "tunables" to increase log storage, as this could impact the stability or performance of the Purity Operating Environment.