audit data

Enables and disables auditing of filesystem and table operations.

For a list of these operations, see Auditing of Filesystem Operations and Table Operations.

Only the mapr user for the cluster can run this command. For more information about the mapr user, see Managing Users and Groups.

Syntax

CLI 
maprcli audit
[ -cluster cluster_name ] 
[ -enabled <true | false> ]
[ -maxsize <GB> ]
[ -retention <number of days> ] 
[ -coalesce <number of minutes> ]
REST

http[s]://<host>:<port>/rest/audit/data?enabled=<true | false>&maxSize=<GB>&retention=<number of days>

Parameters

Parameter Description
cluster The path and name of a remote MapR cluster.
enabled The value true enables auditing, the value false disables it.
maxsize The size in GB at which an alarm is sent to the dashboard in the MapR Control Service. The alarm is to notify the cluster administrator that the audit log is becoming large enough that the administrator might want to take action. For more information about this parameter, the alarm, and possible actions to take, see Managing Audit Logs for Filesystem and Table Operations.

The audit log continues to grow until the administrator takes action or until the retention period ends.

The default value is 32.
retention The period of time in days for which to keep the data in the audit log for the data access. After this period elapses, the content of the file is deleted and new entries are added to the file until the next retention period elapses.
coalesce Sets an interval during which READ, WRITE, or GETATTR operations on one file from one client IP address are logged only once.

For example, suppose that a client application reads a single file three times in 6 minutes, so that there is one read at 0 minutes, another at 3 minutes, and a final read at 6 minutes. If the coalesce interval is at least 6 minutes, then only the first read operation is logged. However, if the interval is between 4 minutes, then only the first and third read operations are logged. If the interval is 2 minutes, all three read operations are logged.

You can set this interval on individual volumes. The default value is 60 minutes. Setting this field to a larger number helps prevent audit logs from growing quickly.