The following types of operations are audited after the
maprcli audit cluster command is run on a cluster:
maprclicommands, REST calls, and actions in MCS that have effects at the cluster level, including those that enable auditing, are audited.
- All authentications to MCS and authentications to MapR clusters via
Audit records for these operations are recorded in the following audit logs:
Audit logs for operations related to cluster management and authentications to clusters via maprlogin
Every CLDB operation is logged in the local filesystem of the CLDB node that responded to the operation. The log file is
Audit logs for
maprcli commands, REST API calls, and actions in MCS
maprcli commands, REST API calls, and actions in MCS are logged in the local filesystem on the nodes where they are executed. Log files are located at
/opt/mapr/mapr-cli-audit-log/audit.log.json. To see what information is recorded in typical log entries, see Example Log Entries for Audited maprcli Command Executions, REST API Calls, and Actions in MCS.
maprcli commands, as well as their equivalent REST API calls and actions in MCS, are also logged in audit logs on the servers where they are processed.
These commands are not audited:
Audit logs for authentications to MCS
Every attempt at authentication to MCS, whether successful or unsuccessful, is logged to the local filesystem in
/opt/mapr/logs/authaudit.log.json on the webserver node where an attempt was made.