Selective Auditing of MapR File System, MapR Database Table, and MapR Event Store For Apache Kafka Operations Using the CLI

Explains how to selectively audit MapR objects.

Administrators can specify filesystem, table, or stream operations to include or exclude from auditing. The operations that can be included or excluded from auditing are listed here.

Including or excluding specific operations from auditing requires running the maprcli command. You can specify the list of operations to include or exclude from auditing during volume creation using the maprcli volume create command, and afterwards using the maprcli volume modify or maprcli volume audit command.

To:

  • Include operations for auditing, use the plus sign (+) before the operation.
  • Exclude operations from auditing, use the minus sign (-) before the operation.
    NOTE If the first operation in the list is to be excluded from auditing, it must be preceded by two minus (--) signs. Subsequent operations to exclude from auditing must be preceded by only a single minus (-) sign, whether or not the first operation was included (using a plus (+) sign) or excluded (using two minus (--) signs).
NOTE If neither (plus (+) or minus (-)) sign is specified before an operation, the given operation is included for auditing.