Welcome to the new DOCS.vastdata.com. We've added new menus and a version selector, plus new persona and resource pages to help customers get started. Looking for a previous article? Use the docs search.

Press CTRL+K to open search

Audited Protocol Operations

Prev Next

Create or Delete Files, Directories, or Objects

This category includes operations that create or delete files or directories (for NFS and SMB), objects (for S3), or tables and schemas (for VAST DB).

You enable logging of these operations by selecting the Create/Delete Files/Directories/Objects option in VAST Web UI audit settings or running the VAST CLI cluster modify command with the --audit operations create_delete_files_dirs_objects option specified.

NFSv3

  • CREATE, when it creates a file

  • MKDIR

  • LINK

  • SYMLINK

  • MKNOD

  • REMOVE

  • RMDIR

  • RENAME

NFSv4

  • CREATE

  • OPEN, when it creates a file

  • LINK

  • REMOVE

  • RENAME

SMB

  • CREATE, when it creates a new file or directory, or opens an existing file in delete-on-close mode

  • SET_INFO, when it is used for delete on close or when it renames a file or directory

  • CLOSE, when it is used for delete on close

S3

  • Bucket-level operations:

    • CreateBucket

    • DeleteBucket

  • Object-level operations:

    • PutObject

    • CopyObject

    • CreateMultipartUpload

    • AbortMultipartUpload

    • CompleteMultipartUpload

    • DeleteObject

    • DeleteObjects

    • DeleteByLifecycleRule

VAST Database

  • CREATE_SCHEMA

  • DROP_SCHEMA

  • CREATE_TABLE

  • DROP_TABLE

  • CREATE_PROJECTION

  • DROP_PROJECTION

  • PUT_BUCKET_LOGGING

  • GET_BUCKET_LOGGING

  • PUT_BUCKET_OWNERSHIP_CONTROLS

  • DELETE_BUCKET_OWNERSHIP_CONTROLS

  • GET_BUCKET_OWNERSHIP_CONTROLS

Modify Data

This category includes operations that modify data. These include operations that change the file size.

You enable logging of these operations by selecting the Modify Data option in VAST Web UI audit settings or running the VAST CLI cluster modify command with the --audit operations modify_data option specified.

NFSv3

  • CREATE, when it truncates a file

  • WRITE

  • SETATTR if setting size

NFSv4

  • OPEN, if it truncates an existing file

  • WRITE

  • SETATTR if setting the attribute results in a change in file size

SMB

  • CREATE, if it truncates an existing file

  • WRITE

  • IOCTL on a file or directory, if it modifies data

  • SET_INFO with FileAllocationInformation, FileEndOfFileInformation, FileValidDataLengthInformation

VAST Database

  • INSERT_ROWS

  • IMPORT_DATA

  • UPDATE_ROWS

  • DELETE_ROWS

Modify Metadata

This category includes operations that modify metadata.

You enable logging of these operations by selecting the Modify Metadata option in VAST Web UI audit settings or running the VAST CLI cluster modify command with the --audit operations modify_data_md option specified.

NFSv3

  • SETATTR if changing an existing attribute

  • SETACL

NFSv4

  • SETATTR if setting the attribute does not result in a change in file size

SMB

  • IOCTL on a file or directory, if it modifies metadata

  • SET_INFO with structures other than FileAllocationInformation, FileEndOfFileInformation, FileValidDataLengthInformation

S3

  • Bucket-level operations:

    • PutBucketAcl

    • PutBucketVersioning

    • PutObjectLockConfiguration

    • PutBucketLifecycleConfiguration

    • PutBucketTagging

    • DeleteBucketTagging

  • Object-level operations:

    • PutObjectAcl

    • PutObjectRetention

    • PutObjectLegalHold

    • PutObjectTagging

    • DeleteObjectTagging

VAST Database

  • ALTER_SCHEMA

  • ALTER_TABLE

  • ADD_COLUMNS

  • ALTER_COLUMN

  • DROP_COLUMNS

  • ALTER_PROJECTIONS

Read Data

This category includes operations that read data.

You enable logging of these operations by selecting the Read Data option in VAST Web UI audit settings or running the VAST CLI cluster modify command with the --audit operations read_data option specified.

NFSv3

  • READ

NFSv4

  • READ

  • VERIFY

SMB

  • READ

S3

  • GetObject

VAST Database

  • SELECT

  • QUERY_DATA

Read Metadata

This category includes operations that read metadata.

You enable logging of these operations by selecting the Read Metadata option in VAST Web UI audit settings or running the VAST CLI cluster modify command with the --audit operations read_data_md option specified.

NFSv3

  • READDIR

  • READDIRPLUS

  • GETACL

  • ACCESS, if the RPC failed or if the granted access is lower than the requested access

NFSv4

  • GETATTR

  • READDIR

  • VERIFY

  • ACCESS

SMB

  • QUERY_DIRECTORY

S3

  • Bucket-level operations:

    • ListAllMyBuckets

    • ListObjects

    • GetBucketLocation

    • HeadBucket

    • GetBucketVersioning

    • GetBucketAcl

    • ListMultipartUploads

    • GetObjectLockConfiguration

  • Object-level operations:

    • HeadObject

    • GetObjectRetention

    • GetObjectLegalHold

VAST Database

  • LIST_SCHEMAS

  • GET_TABLE_STATS

  • LIST_TABLES

  • LIST_COLUMNS

  • GET_PROJECTION_STATS

  • LIST_PROJECTIONS

  • LIST_PROJECTION_COLUMNS

Create or Close Sessions

This category includes session creation and closing operations for sessions that use Kerberos 5 authentication (krb5, krb5i, or krb5p), and also VAST Database transaction operations.

You enable logging of these operations by selecting the Session create/close option in VAST Web UI audit settings or running the VAST CLI cluster modify command with the --audit operations session_create_close option specified.

NFSv4

  • Kerberos user token creation

  • Kerberos user token deletion

SMB

  • SESSION_SETUP

  • LOGOFF

Related articles