Service commands
A subset of the CLI can be audited by setting the SERVICE collect
flag in the History Configuration. The CLI commands in the following
table are captured, and the SERVICETYPE values are used in the history
database.
| Command | SERVICETYPE |
|---|---|
| nzbackup | 1 |
| nzrestore | 2 |
| nzreclaim | 3 |
| nzsfi | 4 |
| nzspu | 5 |
| nzstate | 6 |
| nzstats | 7 |
| nzsystem | 8 |
| nzevent (-dump option) | 9 |
All the commands in previous table are associated with the “system user” login and password. Audited data relates each command invocation to the invoker session.
Even if a service command fails due to lack of privileges, it is still captured. The data does not indicate whether the service finished successfully or not. Service attempts that fail at login based on username/password are captured as failed authentications.
The following list shows certain CLI commands that are not captured,
because they are already audited through SQL or they do not connect
to the database.
- nzcontents
- nzconvert
- nzhostbackup
- nzhostrestore
- nzstart
- nzstop
- nzwebstart
- nzwebstop
- nzload
- nzpassword
- nzsession
- nzsql
- nztopology
- nzrev
- nzinventory
- nzevent (options other than dump)