Applies to VAST Cluster 5.5.
The columns of the audit log table, vast_audit_log_table, in VAST Cluster 5.5, with their types. Some fields apply to every protocol, others to one. A field that doesn't apply to a record is empty. To see the columns and their types on your cluster, run the first block in query the audit log.
Fields for every protocol
| Field | Type | Description |
|---|---|---|
time |
timestamp[ns] |
When the operation (RPC) happened |
time_str |
string |
The same time, as a string |
protocol |
string |
The client protocol that sent the request: S3, NFSv3 or NDB (VAST DataBase) |
rpc_type |
string |
The requested operation, for example PUT_OBJECT |
status |
string |
The result. For S3 and VAST DataBase: Success, or the error code, for example NoSuchKey or InvalidArgument. For NFSv3: the NFS status, for example NFS3_OK or NFS3ERR_ACCES |
object_type |
string |
What the request acted on: DIRECTORY, FILE, SYMLINK, BUCKET, OBJECT (an S3 object, or a VAST DataBase schema or table) or UNKNOWN. VAST DataBase transaction begin, commit and rollback are BUCKET. UNKNOWN appears mostly on failed requests, but also on some successful NFS ones, such as a permission change. |
path |
struct |
The full path, such as /data/logs/app.log, with internal handle information (path.path holds the path). Empty when the cluster isn't set to log full paths. |
view_path |
string |
The path of the view the request came through, such as /data. Set whether or not full paths are logged. |
name |
struct |
The element's path inside the view (for S3, the object key), with internal handle information. When full paths aren't logged, NFS records have only the file name here. |
link_path |
struct |
The target of a file or directory link |
uid |
int32 |
The user's NFS UID |
sid |
string |
The user's SMB SID |
login_name |
string |
The user name. Present only if the cluster is set to log user names, and the name could be retrieved from the authentication provider. Otherwise an empty string. |
tenant |
string |
The name of the tenant the request was for, for example default |
client_ip |
string |
The IP address the request came from |
cluster_vip |
string |
The virtual IP the request arrived on |
cnode_name |
string |
The CNode that handled the request |
cluster_name |
string |
The cluster's name |
num_bytes |
int64 |
Bytes read or written by the operation. 0 for the start and completion of a multipart upload; uploading the parts leaves no records. |
num_ops |
int32 |
How many internal sub-operations the request needed |
S3 fields
| Field | Type | Description |
|---|---|---|
s3_bucket_name |
string |
The bucket |
s3_used_access_key |
string |
The access key that signed the request |
s3_access_keys |
list<item: string> |
The user's S3 access keys. Unused entries of the list are empty strings. |
s3_request_id |
int64 |
The request ID |
s3_version_id |
int64 |
The object version ID; -1 in a bucket without versioning |
s3_version_phandle |
struct |
The internal handle of the object version |
s3_multipart_upload_id |
int64 |
The multipart upload ID, on the records that start and complete the upload |
s3_source_object |
struct |
For copies (PUT_OBJECT_COPY): the source bucket and object, with version and internal handle information |
connection_type |
string |
HTTP or HTTPS, for S3 and VAST DataBase requests |
transaction_id |
int64 |
A correlation key for the request in the cluster's lower-level logs |
true_client_ip |
string |
The original client IP, when requests pass through a proxy or load balancer |
NFS fields
| Field | Type | Description |
|---|---|---|
nfs_rpc_sub_types |
list<item: string> |
Attributes set with the NFSv3 or NFSv4 operation, for example MODE, or ATIME and MTIME |
nfs3_required_permissions, nfs3_granted_permissions |
int32 |
Permissions the NFSv3 operation needed, and those the access check granted |
nfs4_required_access, nfs4_granted_access |
int32 |
The same for NFSv4 |
nfs4_ftype |
string |
The NFSv4 file type (regular file, directory, symbolic link and so on) |
nfs_link_name, nfs_link_path |
string |
For an NFS hard link (LINK): the new link's name and path. path is the existing file |
nfs_symlink |
string |
For SYMLINK: the target the new symbolic link points to. path is the link itself |
rename_name, rename_path |
string |
For a rename or move. In an NFSv3 RENAME record, rename_path is the element's previous path and path its new one; rename_name was empty |
mtls_nfs_client_certificate_info |
string |
The mTLS client certificate used to authenticate the NFS connection |
SMB fields
| Field | Type | Description |
|---|---|---|
smb_create_action |
string |
The kind of create: create, open, overwrite or supersede |
smb_create_disposition |
int32 |
What to do if the file in a create request already exists |
smb_create_option |
int32 |
Options applied when creating or opening the file |
smb_delete_on_close |
bool |
Whether the file was to be deleted when all its handles closed |
smb_info_class |
string |
The class of information requested with GET_INFO |
smb_info_type |
string |
The type of information set with SET_INFO |
smb_rename_struct |
struct |
Details of a move or rename |
smb_ads_name |
struct |
The alternate data stream name, with internal handle information |
See Audit Log Record Attributes.
Operation types
Which operations are recorded, and their names, depend on the protocol and the audited categories. For the list per protocol, see Audited Protocol Operations. Values of rpc_type seen on VAST Cluster 5.5:
| Protocol | rpc_type values seen |
|---|---|
NDB (VAST DataBase) |
BEGIN_TRANSACTION, COMMIT_TRANSACTION, ROLLBACK_TRANSACTION, CREATE_SCHEMA, CREATE_TABLE, LIST_SCHEMAS, LIST_TABLES, LIST_COLUMNS, GET_TABLE_STATS, QUERY_DATA, INSERT_ROWS, UPDATE_ROWS, DELETE_ROWS, ADD_COLUMNS, DROP_COLUMNS, ALTER_COLUMN |
S3 |
PUT_OBJECT, PUT_OBJECT_COPY, PUT_OBJECT_TAGGING, GET_OBJECT, HEAD_OBJECT, DELETE_OBJECT, INITIATE_MULTI_PART_UPLOAD, COMPLETE_MULTI_PART_UPLOAD, LIST_OBJECTS, LIST_OBJECTS_V2, HEAD_BUCKET, PUT_BUCKET, LIST_MULTIPAT_UPLOADS (spelled so) |
NFSv3 |
CREATE, WRITE, READ, MKDIR, SETATTR, SYMLINK, LINK, RENAME, READDIRPLUS, ACCESS, GETACL |
Reading the Catalog or the audit log is audited too, when VAST DataBase operations are: each read request is a QUERY_DATA record on vast-big-catalog-bucket or vast-audit-log-bucket. A Trino query sends many such requests.
Table names
| Database (bucket) | Schema | Table | |
|---|---|---|---|
| Audit log | vast-audit-log-bucket |
vast_audit_log_schema |
vast_audit_log_table |
For the names in Trino and Spark, see Trino and Spark.