This section explains the different formats of audit logs for file system operations that Qumulo Core generates whenever a connected client sends a request to a Qumulo cluster.
Qumulo Core creates a descriptive audit log message for every operation that a client attempts. Then, Qumulo Core sends the audit log messages to the remote syslog instance that the audit logging configuration specifies in compliance with RFC 5424 .
This section explains the differences between the levels of detail of audit logs in syslog CSV, syslog JSON, and CloudWatch JSON formats. (In general, the syslog CSV and CloudWatch JSON formats contain audit logs contain an identical number of fields, some named differently, while the syslog JSON format has additional audit logging information.)
Note
- A Qumulo cluster uses the static IP address assigned to each of its nodes to send audit logs to the audit log server.
-
Qumulo Core doesn't parse, analyze, index, or visualize the data. For more information, see the following articles on Qumulo Care:
Details Included in the Default syslog CSV Format
Note
- Because the user ID, path fields, and secondary path fields can contain characters that must be escaped (such as quotation marks and commas), you must enclose these fields in quotation marks.
- Qumulo Core system strips out the
\nand\rnewline characters from the user ID, file path, and secondary file path fields. - Both syslog CSV and syslog JSON formats deduplicate repeated file reads. However, for metadata changes—such as modifications to an access-control list (ACL)—only the syslog CSV deduplicates repeated operations.
- Unlike the syslog JSON format, the syslog CSV format has only values (no keys) and the fields are empty when unused. The following table helps explain the fields and their possible values.
By default, Qumulo Core formats audit log messages in the syslog CSV format, prefaced by the date, time, and the name of the machine that issues the operation. The syslog CSV format includes the following fields in the following order within the log message body.
| Field | Description | Possible Values |
|---|---|---|
| User IP address | The IP address of the user that performed the operation. |
|
| User ID |
The ID of the user who performed the operation.
Note
Qumulo Core specifies the Qumulo authentication ID if it can’t resolve any of the other user ID types. |
String in quotation marks:
|
| Protocol | The protocol that the operation uses. |
|
| Operation Type | The operation that the user or the system attempts to perform. |
|
| Operation Status | A success status or an error status. |
|
| File ID |
The ID of the file on which the system performed an operation.
Note
For non-file entities, this field is empty. |
Integer |
| File Path |
The path to the file on which the system performed an operation.
Note
For files accessed by using a snapshot, the system prefixes the path with /.snapshot. (This is the same path prefix that the system uses to access snapshotted files through NFSv3 and SMB.) |
String in quotation marks |
| Target File Path | The target path to the file on which the system performed a rename or move operation. | String in quotation marks |
For example:
Jun 6 14:52:28 my-machine qumulo 203.0.113.0,"system",internal,remote_syslog_startup,ok,,"",""
Jun 6 14:52:28 my-machine qumulo 203.0.113.0,"AD\alice",api,audit_modify_syslog_config,ok,,"",""
Jun 6 14:52:40 my-machine qumulo 203.0.113.0,"AD\alice",api,rest_login,ok,,"",""
Jun 6 14:53:22 my-machine qumulo 203.0.113.0,"AD\alice",api,fs_read_metadata,ok,3,"/my_file",""
Jun 6 14:53:22 my-machine qumulo 203.0.113.0,"AD\alice",api,fs_write_metadata,ok,3,"/my_file",""
Jun 6 14:53:22 my-machine qumulo 203.0.113.0,"AD\alice",api,fs_write_data,ok,3,"/my_file",""
Jun 6 14:54:05 my-machine qumulo 203.0.113.0,"AD\alice",api,fs_rename,ok,3,"/my_file","/another_file"
Jun 6 14:55:24 my-machine qumulo 203.0.113.0,"AD\alice",api,begin_audit_modify_syslog_config,ok,,"",""
Jun 6 14:55:24 my-machine qumulo 203.0.113.0,"system",internal,remote_syslog_shutdown,ok,,"","
Details Included in the syslog JSON Format
You can configure Qumulo Core to format audit log messages in the syslog JSON format. The fields in this format are similar to the fields that the syslog CSV format provides, with the following exceptions.
Note
The syslog JSON format isn’t available in the Qumulo Core Web UI.
The syslog JSON format isn’t available in the Qumulo Core Web UI.
| Field | Description | Possible Values |
|---|---|---|
user_id Object |
In Qumulo Core 6.0.1 (and higher) the user_id object replaces the single user ID field in the syslog CSV format and contains the fields sid, auth_id, and name. |
|
details Object |
|
|
For example:
Tip
The following example is too wide for the page. To explore this example, click Reading Mode or scroll the example horizontally.
The following example is too wide for the page. To explore this example, click Reading Mode or scroll the example horizontally.
Jun 6 14:52:28 my-machine qumulo {"user_id": {"auth_id": "1", "sid": "S-1-5-21-9876543210-5678901234-1234567890-1", "name": "system"}, "user_ip": "203.0.113.0", "protocol": "internal", "operation": "remote_syslog_startup", "status": "ok", "details": {}}
Jun 6 14:52:28 my-machine qumulo {"user_id": {"sid": "S-1-5-21-9876543210-5678901234-1234567890-500", "auth_id": "500", "name": "AD\alice"}, "user_ip": "203.0.113.0", "protocol": "api", "operation": "audit_modify_syslog_config", "status": "ok", "details": {"second_extra_name": "", "extra_name": ""}}
Jun 6 14:52:40 my-machine qumulo {"user_id": {"auth_id": "500", "name": "AD\alice", "sid": "S-1-5-21-9876543210-5678901234-1234567890-500"}, "user_ip": "203.0.113.0", "protocol": "api", "operation": "rest_login", "status": "ok", "details": {"second_extra_name": "", "extra_name": ""}}
Jun 6 14:53:22 my-machine qumulo {"user_id": {"sid": "S-1-5-21-9876543210-5678901234-1234567890-500", "name": "AD\alice", "auth_id": "500"}, "user_ip": "203.0.113.0", "protocol": "api", "operation": "fs_read_metadata", "status": "ok", "details": {"path": "/my_file", "file_id": "4"}}
Jun 6 14:53:22 my-machine qumulo {"user_id": {"name": "AD\alice", "sid": "S-1-5-21-9876543210-5678901234-1234567890-500", "auth_id": "500"}, "user_ip": "203.0.113.0", "protocol": "api", "operation": "fs_write_metadata", "status": "ok", "details": {"file_id": "4", "after": {"ctime": "2024-06-11T14:55:58.187394089Z", "mtime": "2024-06-11T14:55:58.187394089Z", "owner": {"sid": "S-1-5-21-9876543210-5678901234-1234567890-500", "auth_id": "500"}}, "path": "/my_file", "before": {"ctime": "2024-06-11T14:55:43.616292461Z", "mtime": "2024-06-11T14:55:43.616292461Z", "owner": {"sid": "S-1-5-21-9876543210-5678901234-1234567890-500", "auth_id": "500"}}}}
Jun 6 14:53:22 my-machine qumulo {"user_id": {"auth_id": "500", "sid": "S-1-5-21-9876543210-5678901234-1234567890-500", "name": "AD\alice"}, "user_ip": "203.0.113.0", "protocol": "api", "operation": "fs_write_data", "status": "ok", "details": {"path": "/my_file", "size": 261456, "file_id": "4", "offset": 0, "file_size": 261456}}
Jun 6 14:54:05 my-machine qumulo {"user_id": {"name": "AD\alice", "auth_id": "500", "sid": "S-1-5-21-9876543210-5678901234-1234567890-500"}, "user_ip": "203.0.113.0", "protocol": "api", "operation": "fs_rename", "status": "fs_entry_exists_error", "details": {"path": "/my_file", "target": "/another_file", "file_id": "4"}}
Jun 6 14:55:24 my-machine qumulo {"user_id": {"sid": "S-1-5-21-9876543210-5678901234-1234567890-500", "auth_id": "500", "name": "AD\alice"}, "user_ip": "203.0.113.0", "protocol": "api", "operation": "begin_audit_modify_syslog_config", "status": "ok", "details": {"second_extra_name": "", "extra_name": ""}}
Jun 6 14:55:24 my-machine qumulo {"user_id": {"auth_id": "1", "sid": "S-1-5-21-9876543210-5678901234-1234567890-1", "name": "system"}, "user_ip": "203.0.113.0", "protocol": "internal", "operation": "remote_syslog_shutdown", "status": "ok", "details": {}}Details Included in the Amazon CloudWatch JSON Format
You can configure Qumulo Core to format audit log messages in the Amazon CloudWatch JSON format.
Tip
To download the audit log from the CloudWatch console, on the left navigation panel click Logs > Log groups, click a log group, and then on the Log events page click Actions > Copy search results (ASCII).
To download the audit log from the CloudWatch console, on the left navigation panel click Logs > Log groups, click a log group, and then on the Log events page click Actions > Copy search results (ASCII).
Rather than preface each line of CSV or JSON with the date and time, CloudWatch creates an ASCII table, which contains Unix timestamps in its first column. The second column contains the fields that are similar to the fields that both the syslog CSV format and the syslog JSON format provide, with the following exceptions.
-
The
resultfield replaces the Operation Status orstatusfield. -
The
object_idfield replaces the File IDfile_idfield. -
The
path_1field replaces the File Path orpathfield. -
The
path_2field replaces the Target File Path ortargetfield.
For example:
Tip
The following example is too wide for the page. To explore this example, click Reading Mode or scroll the example horizontally.
The following example is too wide for the page. To explore this example, click Reading Mode or scroll the example horizontally.
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| timestamp | message |
|---------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1717679548000 | {"ip_address": "203.0.113.0", "user": "system", "protocol": "internal", "operation": "remote_syslog_startup", "result": "ok", "object_id": "", "path_1": "", "path_2": ""} |
| 1717679548000 | {"ip_address": "203.0.113.0", "user": "AD\alice", "protocol": "api", "operation": "audit_modify_syslog_config", "result": "ok", "object_id": "", "path_1": "", "path_2": ""} |
| 1717679560000 | {"ip_address": "203.0.113.0", "user": "AD\alice", "protocol": "api", "operation": "rest_login", "result": "ok", "object_id": "", "path_1": "", "path_2": ""} |
| 1717679602000 | {"ip_address": "203.0.113.0", "user": "AD\alice", "protocol": "api", "operation": "fs_read_metadata", "result": "ok", "object_id": "3", "path_1": "/my_file", "path_2": ""} |
| 1717679602000 | {"ip_address": "203.0.113.0", "user": "AD\alice", "protocol": "api", "operation": "fs_write_metadata", "result": "ok", "object_id": "3", "path_1": "/my_file", "path_2": ""} |
| 1717679602000 | {"ip_address": "203.0.113.0", "user": "AD\alice", "protocol": "api", "operation": "fs_write_data", "result": "ok", "object_id": "3", "path_1": "/my_file", "path_2": ""} |
| 1717679645000 | {"ip_address": "203.0.113.0", "user": "AD\alice", "protocol": "api", "operation": "fs_rename", "result": "ok", "object_id": "3", "path_1": "/my_file", "path_2": "/another_file"} |
| 1717679724000 | {"ip_address": "203.0.113.0", "user": "AD\alice", "protocol": "api", "operation": "begin_audit_modify_syslog_config", "result": "ok", "object_id": "", "path_1": "", "path_2": ""} |
| 1717679724000 | {"ip_address": "203.0.113.0", "user": "system", "protocol": "internal", "operation": "remote_syslog_shutdown", "result": "ok", "object_id": "", "path_1": "", "path_2": ""} |
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------Operation Names in Audit Logging
This section lists the operation names in Qumulo Core audit logging.
Connectivity Operations
ftp_loginnfs_mountrest_loginshare_connectsmb_close_handlesmb_close_sessionsmb_login
SMB-Specific Operations
smb_create_sharesmb_modify_sharesmb_delete_sharesmb2_notify_req
Audit Logging Operations
remote_syslog_shutdownremote_syslog_startup
File System Operations
fs_copy_chunkfs_create_directoryfs_create_directoriesfs_create_filefs_create_hard_linkfs_create_symlinkfs_create_streamfs_createNote
This operation type applies to any but the previous file types.fs_deletefs_fsstatfs_list_directoryfs_openfs_read_datafs_read_linkfs_read_metadatafs_read_user_metadatafs_renamefs_set_quotafs_tree_deletefs_write_datafs_write_metadatafs_write_file_lockfs_write_user_metadata
REST API Operations
Click to expand
ad_cancel_operationad_dismiss_errorad_joinad_kerberos_renew_ticketad_leavead_modify_settingsad_reconfigureaudit_modify_cloudwatch_configaudit_modify_syslog_configauth_add_groupauth_add_member_to_groupauth_assign_roleauth_create_access_tokenauth_create_roleauth_create_userauth_delete_access_tokenauth_delete_groupauth_delete_identity_attributesauth_delete_roleauth_delete_userauth_get_access_tokenauth_get_access_tokensauth_modify_access_tokenauth_modify_groupauth_modify_identity_attributesauth_modify_roleauth_modify_userauth_modify_user_passwordauth_remove_member_from_groupauth_set_user_defined_mappingsauth_unassign_rolecluster_add_nodescluster_calculate_node_add_capacitycluster_generate_vpn_private_keycluster_initiate_node_replacement_plancluster_install_vpn_keyscluster_locate_disk_slotcluster_modify_configcluster_modify_monitoring_configcluster_modify_nodescluster_modify_nodes_dry_runcluster_modify_upgrade_configcluster_nodes_resolve_indeterminate_modificationdns_createdns_deletedns_modifydns_set_lookup_overridesencryption_create_keyencryption_rotate_keysencryption_update_configfs_create_public_keyfs_delete_public_keyfs_modify_atime_settingsfs_modify_notify_settingsfs_modify_permissions_settingsfs_modify_public_keyfs_release_nlm_locks_by_clientfs_release_nlm_locks_by_filefs_replace_public_keyfs_sampleftp_modify_settingsidentity_createidentity_deleteidentity_modifykerberos_delete_keytabkerberos_modify_settingskerberos_set_keytabldap_modify_settingsnetwork_create_confignetwork_delete_confignetwork_modify_confignetwork_modify_interfacenfs_create_exportnfs_delete_exportnfs_delete_settingsnfs_modify_exportnfs_modify_settingsnode_haltnode_restartnode_set_identify_lightportals_authorize_hub_portalportals_create_spoke_portalportals_delete_hub_portalportals_delete_spoke_portalportals_evict_inodeportals_modify_eviction_configurationportals_modify_hub_portalportals_modify_spoke_portalportals_propose_portal_relationshipreboot_pausereboot_resumereboot_startreplication_abortreplication_abort_object_relationshipreplication_authorize_target_relationshipreplication_create_object_relationshipreplication_create_source_relationshipreplication_delete_object_relationshipreplication_delete_source_relationshipreplication_delete_target_relationshipreplication_dismiss_source_relationship_errorreplication_dismiss_target_relationship_errorreplication_make_target_writablereplication_modify_source_relationshipreplication_reconnect_target_relationshipreplication_release_queued_snapshotreplication_replicate_object_relationshipreplication_reverse_target_relationshipreplication_startreplication_target_relationship_locks3_abort_uploads3_add_buckets3_bucket_policy_explain_accesss3_create_keys3_delete_buckets3_delete_keys3_get_bucket_policys3_modify_buckets3_modify_settingss3_put_bucket_policysaml_modify_settingssession_change_passwordshutdown_haltsmb_delete_settingssmb_modify_settingssnapshot_create_policysnapshot_create_snapshotsnapshot_delete_policysnapshot_delete_snapshotsnapshot_lock_snapshotsnapshot_modify_policysnapshot_modify_snapshotsnapshot_unlock_snapshotsnapshot_unlock_snapshot_challegessl_delete_ca_certificatessl_modify_ca_certificatessl_modify_certificatetenant_createtenant_deletetenant_modifytime_modify_configtree_delete_canceltree_delete_startweb_ui_modify_settings
Error Status Messages
This section lists the error status messages in Qumulo Core audit logging.
Credential Error Messages
cred_errorcred_identity_not_supported_errorcred_invalid_local_user_errorcred_invalid_sid_errorcred_remote_resource_unavailable_error
File System Operation Error Messages
Click to expand
fs_access_denied_errorfs_access_errorfs_access_perm_not_owner_errorfs_already_read_only_errorfs_default_stream_of_directory_errorfs_directory_cycle_errorfs_directory_errorfs_directory_hash_exhaustion_errorfs_directory_is_symlink_errorfs_directory_not_empty_errorfs_encountered_portal_errorfs_entry_exists_errorfs_entry_hardlink_ambiguity_errorfs_entry_not_in_subtree_errorfs_exceeded_maximum_stream_count_errorfs_file_dirent_id_stale_errorfs_file_is_named_stream_errorfs_file_is_symlink_errorfs_file_not_covered_by_snapshot_errorfs_file_not_empty_errorfs_file_path_invalid_errorfs_file_size_errorfs_file_too_many_links_errorfs_invalid_acl_errorfs_invalid_attrs_errorfs_invalid_file_type_errorfs_invalid_name_errorfs_invalid_offset_errorfs_invalid_size_errorfs_name_size_errorfs_no_such_entry_errorfs_no_such_file_version_errorfs_no_such_inode_errorfs_no_such_path_errorfs_not_a_directory_errorfs_not_a_file_errorfs_not_a_symlink_errorfs_opened_file_stale_errorfs_path_size_errorfs_permissions_mode_operation_unsupported_errorfs_portal_create_orphanage_errorfs_portal_disconnected_errorfs_portal_errorfs_portal_eviction_errorfs_portal_inconsistent_data_errorfs_portal_incorrect_state_errorfs_portal_invalid_lease_break_range_errorfs_portal_not_covered_by_snapshot_errorfs_portal_not_found_errorfs_portal_out_of_order_lease_break_errorfs_quota_limit_already_set_errorfs_quota_limit_does_not_exist_errorfs_quota_no_space_errorfs_read_only_errorfs_revision_mismatch_errorfs_s3_versioning_full_errorfs_same_inode_errorfs_sharing_violation_errorfs_smb_share_root_deleted_errorfs_stream_is_default_errorfs_symlink_loop_errorfs_tag_mismatch_errorfs_too_many_aces_errorfs_user_metadata_continuation_token_type_mismatchfs_user_metadata_empty_insertion_errorfs_user_metadata_hash_exhaustion_errorfs_user_metadata_key_already_existsfs_user_metadata_key_not_foundfs_user_metadata_too_largefs_watcher_missed_events_error