---
title: "Audited Protocol Operations"
slug: "audited-protocol-operations"
tags: ["5.5"]
updated: 2026-10-27T23:00:54Z
published: 2026-10-27T23:00:54Z
canonical: "docs.vastdata.com/audited-protocol-operations"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audited Protocol Operations

- [Create or Delete Files, Directories, or Objects](/docs-5-5/docs/audited-protocol-operations#create-or-delete-files-directories-or-objects)
- [Modify Data](/docs-5-5/docs/audited-protocol-operations#modify-data)
- [Modify Metadata](/docs-5-5/docs/audited-protocol-operations#modify-metadata)
- [Read Data](/docs-5-5/docs/audited-protocol-operations#read-data)
- [Read Metadata](/docs-5-5/docs/audited-protocol-operations#read-metadata)
- [Create or Close Sessions](/docs-5-5/docs/audited-protocol-operations#create-or-close-sessions)

## Create or Delete Files, Directories, or Objects

This category includes operations that create or delete files or directories (for NFS and SMB), objects (for S3), or tables and schemas (for VAST DB).

You enable logging of these operations by selecting the Create/Delete Files/Directories/Objects option in VAST Web UI audit settings or running the VAST CLI `cluster modify` command with the `--audit operations create_delete_files_dirs_objects` option specified.

### NFSv3

- CREATE, when it creates a file
- MKDIR
- LINK
- SYMLINK
- MKNOD
- REMOVE
- RMDIR
- RENAME

### NFSv4

- CREATE
- OPEN, when it creates a file
- LINK
- REMOVE
- RENAME

### SMB

- CREATE, when it creates a new file or directory, or opens an existing file in delete-on-close mode
- SET_INFO, when it is used for delete on close or when it renames a file or directory
- CLOSE, when it is used for delete on close

### S3

- Bucket-level operations:
  - CreateBucket
  - DeleteBucket
- Object-level operations:
  - PutObject
  - CopyObject
  - CreateMultipartUpload
  - AbortMultipartUpload
  - CompleteMultipartUpload
  - DeleteObject
  - DeleteObjects
  - DeleteByLifecycleRule

### VAST Database

- CREATE_SCHEMA
- DROP_SCHEMA
- CREATE_TABLE
- DROP_TABLE
- CREATE_PROJECTION
- DROP_PROJECTION
- PUT_BUCKET_LOGGING
- GET_BUCKET_LOGGING
- PUT_BUCKET_OWNERSHIP_CONTROLS
- DELETE_BUCKET_OWNERSHIP_CONTROLS
- GET_BUCKET_OWNERSHIP_CONTROLS

## Modify Data

This category includes operations that modify data. These include operations that change the file size.

You enable logging of these operations by selecting the Modify Data option in VAST Web UI audit settings or running the VAST CLI `cluster modify` command with the `--audit operations modify_data` option specified.

### NFSv3

- CREATE, when it truncates a file
- WRITE
- SETATTR if setting size

### NFSv4

- OPEN, if it truncates an existing file
- WRITE
- SETATTR if setting the attribute results in a change in file size

### SMB

- CREATE, if it truncates an existing file
- WRITE
- IOCTL on a file or directory, if it modifies data
- SET_INFO with FileAllocationInformation, FileEndOfFileInformation, FileValidDataLengthInformation

### VAST Database

- INSERT_ROWS
- IMPORT_DATA
- UPDATE_ROWS
- DELETE_ROWS

## Modify Metadata

This category includes operations that modify metadata.

You enable logging of these operations by selecting the Modify Metadata option in VAST Web UI audit settings or running the VAST CLI `cluster modify` command with the `--audit operations modify_data_md` option specified.

### NFSv3

- SETATTR if changing an existing attribute
- SETACL

### NFSv4

- SETATTR if setting the attribute does not result in a change in file size

### SMB

- IOCTL on a file or directory, if it modifies metadata
- SET_INFO with structures other than FileAllocationInformation, FileEndOfFileInformation, FileValidDataLengthInformation

### S3

- Bucket-level operations:
  - PutBucketAcl
  - PutBucketVersioning
  - PutObjectLockConfiguration
  - PutBucketLifecycleConfiguration
  - PutBucketTagging
  - DeleteBucketTagging
- Object-level operations:
  - PutObjectAcl
  - PutObjectRetention
  - PutObjectLegalHold
  - PutObjectTagging
  - DeleteObjectTagging

### VAST Database

- ALTER_SCHEMA
- ALTER_TABLE
- ADD_COLUMNS
- ALTER_COLUMN
- DROP_COLUMNS
- ALTER_PROJECTIONS

## Read Data

This category includes operations that read data.

You enable logging of these operations by selecting the Read Data option in VAST Web UI audit settings or running the VAST CLI `cluster modify` command with the `--audit operations read_data` option specified.

### NFSv3

- READ

### NFSv4

- READ
- VERIFY

### SMB

- READ

### S3

- GetObject

### VAST Database

- SELECT
- QUERY_DATA

## Read Metadata

This category includes operations that read metadata.

You enable logging of these operations by selecting the Read Metadata option in VAST Web UI audit settings or running the VAST CLI `cluster modify` command with the `--audit operations read_data_md` option specified.

### NFSv3

- READDIR
- READDIRPLUS
- GETACL
- ACCESS, if the RPC failed or if the granted access is lower than the requested access

### NFSv4

- GETATTR
- READDIR
- VERIFY
- ACCESS

### SMB

- QUERY_DIRECTORY

### S3

- Bucket-level operations:
  - ListAllMyBuckets
  - ListObjects
  - GetBucketLocation
  - HeadBucket
  - GetBucketVersioning
  - GetBucketAcl
  - ListMultipartUploads
  - GetObjectLockConfiguration
- Object-level operations:
  - HeadObject
  - GetObjectRetention
  - GetObjectLegalHold

### VAST Database

- LIST_SCHEMAS
- GET_TABLE_STATS
- LIST_TABLES
- LIST_COLUMNS
- GET_PROJECTION_STATS
- LIST_PROJECTIONS
- LIST_PROJECTION_COLUMNS

## Create or Close Sessions

This category includes session creation and closing operations for sessions that use Kerberos 5 authentication (*krb5*, *krb5i*, or *krb5p*), and also VAST Database transaction operations.

You enable logging of these operations by selecting the Session create/close option in VAST Web UI audit settings or running the VAST CLI `cluster modify` command with the `--audit operations session_create_close` option specified.

### NFSv4

- Kerberos user token creation
- Kerberos user token deletion

### SMB

- SESSION_SETUP
- LOGOFF

###