Selective Auditing of File-System, Table, and Stream Operations Using the CLI

Explains how to audit Data Fabric objects selectively.

Administrators can specify file-system, table, or stream operations to include or exclude from auditing. The operations that can be included or excluded from auditing are listed here.

Including or excluding specific operations from auditing requires running the maprcli command. You can specify the list of operations to include or exclude from auditing during volume creation using the maprcli volume create command, and afterwards using the maprcli volume modify or maprcli volume audit command.

To:

• Include operations for auditing, use the plus sign (+) before the operation.
• Exclude operations from auditing, use the minus sign (-) before the operation.
  NOTE

  If the first operation in the list is to be excluded from auditing, it must be preceded by two minus (--) signs. Subsequent operations to exclude from auditing must be preceded by only a single minus (-) sign, whether or not the first operation was included (using a plus (+) sign) or excluded (using two minus (--) signs).