Enabling or skipping filesets with file audit logging
With fileset file audit logging, you can specify a list of filesets to apply file audit logging to or to skip it from within a file system.
To enable file audit
logging so that it is applied to a specific
list of filesets only, run a command similar to the following
example:
mmaudit Device enable --filesets FilesetName1[,FilesetName2,...,FilesetNamen]To enable file audit
logging so that it is applied to an entire
file system except a specific list of filesets, run a command similar to the following example:
mmaudit Device enable --skip-filesets FilesetName1[,FilesetName2,...,FilesetNamen]Note:
- For an example, see the mmaudit command.
- For more information about validating that a node is getting events
after file audit logging is enabled, see Monitoring the file audit logging fileset for events.
Important:
- Filesets can be independent or dependent.
- You can set the filesets when file audit logging is being enabled only. You cannot change them using the mmaudit upgrade command.
- The --skip-filesets option cannot be used in combination with the --filesets option. There can only be one audit type per file system: file system, fileset, or skip fileset.
- None of the listed filesets can be .msgq, the audit fileset, the cesSharedRoot, or the default Object fileset.
- There is a limit of 20 filesets that can be specified for the --filesets option and the --skip-filesets option.
- All filesets in the lists of the --filesets option or the --skip-filesets option must be linked in the file system that is specified by mmaudit Device enable.
- If a clustered watch folder secondary sink is included with the --filesets option or the --skip-filesets option, it is always skipped due to the policy rules for clustered watch folder.
- Events are not generated for nested dependent or independent filesets
under an independent fileset that is specified by --filesets.
- Events are generated for nested dependent or independent filesets
under an independent fileset that is specified by --skip-filesets.