mc admin audit

Describes how S3 auditing works in HPE Ezmeral Data Fabric Object Store. Provides the command for bucket and account operations auditing. Also provides the command to view the audit status of bucket and account operations.

Starting in HPE Ezmeral Data Fabric 7.3.0, Object Store supports auditing of S3 operations at the global, account, and bucket levels. You can run the mc admin audit set alias command to set auditing flags at each level. Flags are disabled by default.

The following table lists the flag levels with descriptions:

Flag Level	Description	Operations Audited	Supported Flags
Global	Controls all levels of auditing. When enabled, audits operations on the moss server, accounts, and buckets. When disabled, no operations are audited.	Create account Delete account Changes to account properties	auditenable
Account	Controls auditing of operations at the account level. When enabled, operations on accounts are audited. Use forceauditenable to override the global audit setting for accounts. When the forceauditenable flag is enabled at the account level, all operations at the account and bucket levels are audited regardless of the bucket level audit setting. For example, if the auditenable flag is disabled at the bucket level, all account-level and bucket-level operations are audited.	IAM operations: Create users/groups/policies Delete users/groups/policies Edit users/groups/policies	auditenable, forceauditenable
Bucket	Controls auditing at the bucket level. When enabled, operations on buckets are audited.	Create object Delete object Changes to object properties	auditenable

Flag Level

Description

Operations Audited

Supported Flags

Global

Controls all levels of auditing. When enabled, audits operations on the moss server, accounts, and buckets. When disabled, no operations are audited.

Create account
Delete account
Changes to account properties

auditenable

Account

Controls auditing of operations at the account level. When enabled, operations on accounts are audited.

Use forceauditenable to override the global audit setting for accounts.

When the forceauditenable flag is enabled at the account level, all operations at the account and bucket levels are audited regardless of the bucket level audit setting. For example, if the auditenable flag is disabled at the bucket level, all account-level and bucket-level operations are audited.

IAM operations:
- Create users/groups/policies
- Delete users/groups/policies
- Edit users/groups/policies

auditenable, forceauditenable

Bucket

Controls auditing at the bucket level. When enabled, operations on buckets are audited.

Create object
Delete object
Changes to object properties

auditenable

You can also run the mc admin audit info alias command to get the audit status of buckets and accounts.

Audit Logs

The CLDB creates a volume for audit records when the first MOSS server registers with the cluster. When the MOSS server starts, it creates a folder in the audit volume that stores audit logs for each node.

Audit Commands

The following topics provide the commands to enable auditing of account and bucket operations in HPE Ezmeral Data Fabric Object Store: