Selective Auditing of MapR-FS, MapR-DB Table, and MapR Streams Operations

Administrators can specify filesystem, table, or stream operations to include or exclude from auditing. The operations that can be included or excluded from auditing are listed here.

Including or excluding specific operations from auditing requires running the maprcli command. You can specify the list of operations to include or exclude from auditing during volume creation using maprcli volume create command and afterwards using maprcli volume modify or maprcli volume audit command.

To:

• Include operations for auditing, use the plus sign (+) before the operation.
• Exclude operations from auditing, use the minus sign (-) before the operation.
  NOTE: If the first operation in the list is to be excluded from auditing, it must be preceded by two minus (--) signs. Subsequent operations to exclude from auditing must be preceded by only a single minus (-) sign, whether or not the first operation was included (using a plus (+) sign) or excluded (using two minus (--) signs).