Enabling or skipping filesets with file audit logging
With fileset file audit logging, you can specify a list of filesets to apply file audit logging to or to skip it from within a file system.
To enable file audit
logging so that it is applied to a specific
list of filesets only, run a command similar to the following
example:
mmaudit Device enable --filesets {Fileset[,Fileset...]|ListFilePath}|To enable file audit
logging so that it is applied to an entire
file system except a specific list of filesets, run a command similar to the following example:
mmaudit Device enable --skip-filesets {Fileset[,Fileset...]|ListFilePath}|Note:
- For an example, see the mmaudit command.
- For more information about validating that a node is getting events after file audit logging is enabled, see Monitoring the file audit logging fileset for events.
Important:
- Filesets can be independent or dependent.
- The --enable-filesets option cannot be used in combination with the --disable-filesets option. There can only be one audit type updated at a time.
- The root fileset can be specified as input.
- The --skip-filesets option cannot be used in combination with the --filesets option. There can only be one audit type per file system: file system, fileset, or skip fileset.
- None of the listed filesets can be .msgq, the audit fileset, the cesSharedRoot, or the default Object fileset.
- There is a limit of 20 filesets for file system prior to 5.1.3 (27.0 file system version).
- All filesets in the lists of the --filesets, --skip-filesets, --enable-filesets or --disable-filesets option must be linked in the file system that is specified by mmaudit Device enable or update.
- Events are not generated for nested dependent or independent filesets under an independent fileset that is specified by --filesets or --enable-filesets option.
- Events are generated for nested dependent or independent filesets under an independent fileset that is specified by --skip-filesets or --disable-filesets option.