Actions that the mmaudit command takes to enable file audit logging

Describes the actions that are taken when the mmaudit command enables file audit logging.

Note:
  • If any of the following steps fail, then the entire enablement of file audit logging for the file system fails.
  • Any updates to the configuration or filesets are rolled back so that the cluster is not left in a state where a file system is partially enabled for file audit logging.
  1. Checks that the file system is mounted locally. The file system is the file system where the file audit logging fileset is located that contains the audit log files.
  2. Updates the audit configuration with the file audit logging configuration information, which includes the file system that is being audited and the audit log fileset name among other attributes.
  3. If it is needed, it creates the audit log fileset on the device that is specified in the configuration. By default, the fileset is created in IAM mode non compliant. If the --compliant flag is specified when file audit logging is being enabled, then the fileset is created in IAM mode compliant.
    Note: For more information, see The file audit logging fileset.
  4. Creates the policy partitions that are used to receive lightweight events and block lightweight events from certain filesets and paths:
    1. Creates the policy partition that is used to receive lightweight events for the file system device that is being audited.
    2. If needed, creates policy partitions to skip file system operations in the file audit logging fileset.
    3. If needed, creates global policy partitions to skip known paths (such as the CES shared root) where lightweight events are not wanted.
  5. Changes the file system configuration so that the mmlsfs command with the --file-audit-log option shows as yes.
To verify the settings of one or more file systems that are enabled for file audit logging, run the mmaudit all list command. This command displays the configuration information for all file systems that are configured for file audit logging. Running the mmaudit all list command displays output similar to the following example: 
mmaudit all list
Audit              Cluster              Audit Fileset      Retention  Audit Type          
Device             ID                   Name               (Days)     (Possible Filesets)
------------------------------------------------------------------------------------------
fs0                11430652110915196903 john1              25         FILESET            
                                                                      dep1,dep2,ind1,ind2
fs1                11430652110915196903 john2              75         SKIPFILESET        
                                                                      dep1,dep2,ind1,ind2
fs2                11430652110915196903 john3              25         FSYS