---
title: "Configuring Global Auditing Settings"
slug: "configuring-global-auditing-settings-tg"
tags: ["5.5"]
updated: 2026-10-27T23:00:54Z
published: 2026-10-27T23:00:54Z
canonical: "docs.vastdata.com/configuring-global-auditing-settings-tg"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Global Auditing Settings

# 

- [Configuring Global Auditing Settings in VAST Web UI](/docs-5-5/docs/configuring-global-auditing-settings-tg#configuring-global-auditing-settings-in-vast-web-ui)
- [Configuring Global Auditing Settings in VAST CLI](/docs-5-5/docs/configuring-global-auditing-settings-tg#configuring-global-auditing-settings-in-vast-cli)

## Configuring Global Auditing Settings in VAST Web UI

1. From the left navigation menu, select Settings and then Auditing.
2. Complete the General settings:

| Audit directory name | Specify a name for the audit directory. A directory of this name will be created directly under the root directory of the default tenant in the Element Store. Audit records are written to this directory. The default is `.vast_audit_dir`. |
| --- | --- |
| Read-access Users | List users to grant them read access to all files in the audit directory. Specify each user by user name. Enter a comma to start entering a new user. Each user name appears with a removal button so that you can remove if needed while you are editing the field. > [!TIP] > **Tip** > > To make the audit directory accessible to clients, create a view on the directory. |
| Read-access Groups | List groups to grant them read access to all files in the audit directory. Specify each group by group name. Enter a comma to start entering a new group. Each group name appears with a removal button so that you can remove if needed while you are editing the field. > [!TIP] > **Tip** > > To make the audit directory accessible to clients, create a view on the directory. |
| Size limit per audit file | The maximum size of each file of audit records in the audit directory. Audit records are written to subdirectories of the audit directory per CNode core. Records written to each directory roll over to a new file when the file reaches this size. This setting limits the size of each audit file, but it does not limit the total size of all audit files. Specify the value with units of MB, GB, TB and so on. Default: 1GB |
| Size limit per audit directory | The maximum size of the audit directory. Specify the value with units of MB, GB, TB and so on. By default, the audit directory size is not limited. |
3. Under Define retention period, select one of the following:

  - Keep forever. Audit files are kept for an unlimited period of time.
  - Define retention manually (default). Choose this option to manually set the retention period for keeping audit files. Enter an integer and select the unit of measurement from the dropdown. The default is one hour.
4. Under Auditing, select where to store audit logs:

  - Save audit logs to VAST DB. Audit logs are saved in a VAST DataBase table and can be viewed in the VAST Audit Log page (DataBase -> VAST Audit Log).
  - Save audit logs to file (JSON format). Audit logs are saved in JSON format into a file in the directory specified in the Audit directory name field.

You can enable both options at the same time, in which case audit logs will be saved in both locations.
5. Under Global Baseline Audit Settings, optionally set auditing settings to apply globally to all views. Any settings that you do not enable here can be [set per view policy](/docs-5-5/docs/en/configuring-auditing-with-view-policies). Settings that you do enable here will apply to all views, even if the view policy does not have these settings. Configuring Auditing with View Policies

  1. Toggle the Enable option on. Default global audit settings are now enabled.
  2. Under Select protocols to assign operations, select one or more protocols to enable auditing of protocol operations.
  3. Under Operations to audit, choose one or more [categories of operations](/docs-5-5/docs/clone-audited-protocol-operations) to be audited for the protocol(s) for which auditing is enabled:

| Create/Delete Files/Directories/Objects | Operations that create or delete files, directories, or objects. |
| --- | --- |
| Modify Data | Operations that modify data. This includes operations that change the file size. |
| Modify Metadata | Operations that modify metadata. |
| Read Data | Operations that read data. |
| Read Metadata | Operations that read metadata. |
| Session create/close | For sessions that use Kerberos 5 authentication (*krb5*, *krb5i*, or *krb5p*), the session creation and closing operations. |
  4. Optionally change the Audit record options:

| Log Full Path | If enabled (default for all protocols), audit records contain the full Element Store path to the requested resource. This may affect performance. When disabled, only the view path and the file name are recorded. |
| --- | --- |
| Log Username | If enabled, audit records contain the username (if a username can be retrieved from the auth provider). Disabled by default. |
| Log Extended Error Information | If enabled, additional S3 and STS error information is logged. |
6. Click Save.

## Configuring Global Auditing Settings in VAST CLI

- To view the currently enabled global auditing settings, run the `cluster show` command with the `--audit` parameter.
- To configure global auditing settings, run the `cluster modify` command.

For example, the following command sets the audit directory name to `vast_audit_dir`, grants read access for the audit files to the user *janef* and enables auditing of a few types of NFSv3 and SMB operations:

```plaintext
vcli: admin> cluster modify --id 1 --audit-protocols NFSv3,SMB --read-access-users janef
 --audit-operations create_delete_files_dirs_objects,modify_data_md,read_data
  --audit-dir-name .vast_audit_dir --enable-audit-settings
```