---
title: "Protocol Auditing Overview"
slug: "protocol-auditing-overview-tg"
tags: ["5.5"]
updated: 2026-10-27T23:00:54Z
published: 2026-10-27T23:00:54Z
canonical: "docs.vastdata.com/protocol-auditing-overview-tg"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Protocol Auditing Overview

Protocol auditing is available for recording SMB, NFSv4, NFSv3, S3 and VAST DataBase operations performed by clients on VAST Cluster.

Audit records report the time each operation was performed, identity attributes of the client user, the type of operation requested, the path accessed, affected files, directories or objects, and the success of the operation. Protocol auditing provides you with a way to understand exactly what your users did on the storage system. The audit information is saved in structured JSON format or as records in a [VAST DataBase](/docs-5-5/docs/vast-database-overview-tg) table. You can use the information to analyze user data consumption and to automate and validate security reviews.

A global auditing policy sets global configuration settings such as the name of the audit directory, audit file size limit and so on. It also determines which protocols and operations are audited on all views. You can also configure an audit policy within each view policy which specifies additional actions and protocols to record for the views attached to the view policy.

> [!WARNING]
> Important
> 
> Protocol auditing configuration at the view policy level can only *extend* auditing beyond the global configuration. It cannot decrease the auditing scope from the global configuration.