---
title: "Audit log schema"
slug: "dev-catalog-reference-audit-log-schema"
updated: 2026-10-28T02:14:59Z
published: 2026-10-28T02:14:59Z
canonical: "docs.vastdata.com/dev-catalog-reference-audit-log-schema"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log schema

*Applies to VAST Cluster 5.5.*

The columns of the audit log table, `vast_audit_log_table`, in VAST Cluster 5.5, with their types. Some fields apply to every protocol, others to one. A field that doesn't apply to a record is empty. To see the columns and their types on your cluster, run the first block in [query the audit log](/develop/docs/dev-catalog-guides-audit-log#look-at-the-columns).

## Fields for every protocol

| Field | Type | Description |
| --- | --- | --- |
| `time` | `timestamp[ns]` | When the operation (RPC) happened |
| `time_str` | `string` | The same time, as a string |
| `protocol` | `string` | The client protocol that sent the request: `S3`, `NFSv3` or `NDB` (VAST DataBase) |
| `rpc_type` | `string` | The requested operation, for example `PUT_OBJECT` |
| `status` | `string` | The result. For S3 and VAST DataBase: `Success`, or the error code, for example `NoSuchKey` or `InvalidArgument`. For NFSv3: the NFS status, for example `NFS3_OK` or `NFS3ERR_ACCES` |
| `object_type` | `string` | What the request acted on: `DIRECTORY`, `FILE`, `SYMLINK`, `BUCKET`, `OBJECT` (an S3 object, or a VAST DataBase schema or table) or `UNKNOWN`. VAST DataBase transaction begin, commit and rollback are `BUCKET`. `UNKNOWN` appears mostly on failed requests, but also on some successful NFS ones, such as a permission change. |
| `path` | `struct` | The full path, such as `/data/logs/app.log`, with internal handle information (`path.path` holds the path). Empty when the cluster isn't set to log full paths. |
| `view_path` | `string` | The path of the view the request came through, such as `/data`. Set whether or not full paths are logged. |
| `name` | `struct` | The element's path inside the view (for S3, the object key), with internal handle information. When full paths aren't logged, NFS records have only the file name here. |
| `link_path` | `struct` | The target of a file or directory link |
| `uid` | `int32` | The user's NFS UID |
| `sid` | `string` | The user's SMB SID |
| `login_name` | `string` | The user name. Present only if the cluster is set to log user names, and the name could be retrieved from the authentication provider. Otherwise an empty string. |
| `tenant` | `string` | The name of the tenant the request was for, for example `default` |
| `client_ip` | `string` | The IP address the request came from |
| `cluster_vip` | `string` | The virtual IP the request arrived on |
| `cnode_name` | `string` | The CNode that handled the request |
| `cluster_name` | `string` | The cluster's name |
| `num_bytes` | `int64` | Bytes read or written by the operation. 0 for the start and completion of a multipart upload; uploading the parts leaves no records. |
| `num_ops` | `int32` | How many internal sub-operations the request needed |

## S3 fields

| Field | Type | Description |
| --- | --- | --- |
| `s3_bucket_name` | `string` | The bucket |
| `s3_used_access_key` | `string` | The access key that signed the request |
| `s3_access_keys` | `list<item: string>` | The user's S3 access keys. Unused entries of the list are empty strings. |
| `s3_request_id` | `int64` | The request ID |
| `s3_version_id` | `int64` | The object version ID; `-1` in a bucket without versioning |
| `s3_version_phandle` | `struct` | The internal handle of the object version |
| `s3_multipart_upload_id` | `int64` | The multipart upload ID, on the records that start and complete the upload |
| `s3_source_object` | `struct` | For copies (`PUT_OBJECT_COPY`): the source bucket and object, with version and internal handle information |
| `connection_type` | `string` | `HTTP` or `HTTPS`, for S3 and VAST DataBase requests |
| `transaction_id` | `int64` | A correlation key for the request in the cluster's lower-level logs |
| `true_client_ip` | `string` | The original client IP, when requests pass through a proxy or load balancer |

## NFS fields

| Field | Type | Description |
| --- | --- | --- |
| `nfs_rpc_sub_types` | `list<item: string>` | Attributes set with the NFSv3 or NFSv4 operation, for example `MODE`, or `ATIME` and `MTIME` |
| `nfs3_required_permissions`, `nfs3_granted_permissions` | `int32` | Permissions the NFSv3 operation needed, and those the access check granted |
| `nfs4_required_access`, `nfs4_granted_access` | `int32` | The same for NFSv4 |
| `nfs4_ftype` | `string` | The NFSv4 file type (regular file, directory, symbolic link and so on) |
| `nfs_link_name`, `nfs_link_path` | `string` | For an NFS hard link (`LINK`): the new link's name and path. `path` is the existing file |
| `nfs_symlink` | `string` | For `SYMLINK`: the target the new symbolic link points to. `path` is the link itself |
| `rename_name`, `rename_path` | `string` | For a rename or move. In an NFSv3 `RENAME` record, `rename_path` is the element's previous path and `path` its new one; `rename_name` was empty |
| `mtls_nfs_client_certificate_info` | `string` | The mTLS client certificate used to authenticate the NFS connection |

## SMB fields

| Field | Type | Description |
| --- | --- | --- |
| `smb_create_action` | `string` | The kind of create: create, open, overwrite or supersede |
| `smb_create_disposition` | `int32` | What to do if the file in a create request already exists |
| `smb_create_option` | `int32` | Options applied when creating or opening the file |
| `smb_delete_on_close` | `bool` | Whether the file was to be deleted when all its handles closed |
| `smb_info_class` | `string` | The class of information requested with `GET_INFO` |
| `smb_info_type` | `string` | The type of information set with `SET_INFO` |
| `smb_rename_struct` | `struct` | Details of a move or rename |
| `smb_ads_name` | `struct` | The alternate data stream name, with internal handle information |

See [Audit Log Record Attributes](/docs-5-5/docs/audit-log-record-fields).

## Operation types

Which operations are recorded, and their names, depend on the protocol and the audited categories. For the list per protocol, see [Audited Protocol Operations](/docs-5-5/docs/audited-protocol-operations). Values of `rpc_type` seen on VAST Cluster 5.5:

| Protocol | `rpc_type` values seen |
| --- | --- |
| `NDB` (VAST DataBase) | `BEGIN_TRANSACTION`, `COMMIT_TRANSACTION`, `ROLLBACK_TRANSACTION`, `CREATE_SCHEMA`, `CREATE_TABLE`, `LIST_SCHEMAS`, `LIST_TABLES`, `LIST_COLUMNS`, `GET_TABLE_STATS`, `QUERY_DATA`, `INSERT_ROWS`, `UPDATE_ROWS`, `DELETE_ROWS`, `ADD_COLUMNS`, `DROP_COLUMNS`, `ALTER_COLUMN` |
| `S3` | `PUT_OBJECT`, `PUT_OBJECT_COPY`, `PUT_OBJECT_TAGGING`, `GET_OBJECT`, `HEAD_OBJECT`, `DELETE_OBJECT`, `INITIATE_MULTI_PART_UPLOAD`, `COMPLETE_MULTI_PART_UPLOAD`, `LIST_OBJECTS`, `LIST_OBJECTS_V2`, `HEAD_BUCKET`, `PUT_BUCKET`, `LIST_MULTIPAT_UPLOADS` (spelled so) |
| `NFSv3` | `CREATE`, `WRITE`, `READ`, `MKDIR`, `SETATTR`, `SYMLINK`, `LINK`, `RENAME`, `READDIRPLUS`, `ACCESS`, `GETACL` |

Reading the Catalog or the audit log is audited too, when VAST DataBase operations are: each read request is a `QUERY_DATA` record on `vast-big-catalog-bucket` or `vast-audit-log-bucket`. A Trino query sends many such requests.

## Table names

|  | Database (bucket) | Schema | Table |
| --- | --- | --- | --- |
| Audit log | `vast-audit-log-bucket` | `vast_audit_log_schema` | `vast_audit_log_table` |

For the names in Trino and Spark, see [Trino and Spark](/develop/docs/dev-catalog-integrations-trino-and-spark#table-names).

## See also

- [Concepts: the audit log](/develop/docs/dev-catalog-concepts-index#the-audit-log).
- [Query the audit log](/develop/docs/dev-catalog-guides-audit-log).