When system events occur, the StorageGRID system generates audit messages and records them in the audit log.
APCT: Archive Purge from Cloud-Tier
This message is generated when archived object data is deleted from an external archival storage system, which connects to the StorageGRID through the S3 API.
ARCB: Archive Object Retrieve Begin
This message is generated when a request is made to retrieve archived object data and the retrieval process begins. Retrieval requests are processed immediately, but can be reordered to improve efficiency of retrieval from linear media such as tape.
ARCE: Archive Object Retrieve End
This message is generated when an attempt by the Archive Node to retrieve object data from an external archival storage system completes. If successful, the message indicates that the requested object data has been completely read from the archive location, and was successfully verified. After the object data has been retrieved and verified, it is delivered to the requesting service.
ARCT: Archive Retrieve from Cloud-Tier
This message is generated when archived object data is retrieved from an external archival storage system, which connects to the StorageGRID through the S3 API.
AREM: Archive Object Remove
The Archive Object Remove audit message indicates that a content block was successfully or unsuccessfully deleted from an Archive Node. If the result is successful, the Archive Node has successfully informed the external archival storage system that StorageGRID has released an object location. Whether the object is removed from the external archive storage system depends on the type of system and its configuration.
ASCE: Archive Object Store End
This message indicates that writing a content block to an external archival storage system has ended.
ASCT: Archive Store Cloud-Tier
This message is generated when archived object data is stored to an external archival storage system, which connects to StorageGRID through the S3 API.
ATCE: Archive Object Store Begin
This message indicates that writing a content block to an external archival storage has started.
CBRB: Object Receive Begin
During normal system operations, content blocks are continuously transferred between different nodes as data is accessed, replicated and retained. When transfer of a content block from one node to another is initiated, this message is issued by the destination entity.
CBRE: Object Receive End
When transfer of a content block from one node to another is completed, this message is issued by the destination entity.
CBSB: Object Send Begin
During normal system operations, content blocks are continuously transferred between different nodes as data is accessed, replicated and retained. When transfer of a content block from one node to another is initiated, this message is issued by the source entity.
CBSE: Object Send End
When transfer of a content block from one node to another is completed, this message is issued by the source entity.
GNRG: GNDS Registration
The CMN service generates this audit message when a service has updated or registered information about itself in the StorageGRID system.
GNUR: GNDS Unregistration
The CMN service generates this audit message when a service has unregistered information about itself from the StorageGRID system.
GTED: Grid Task Ended
This audit message indicates that the CMN service has finished processing the specified grid task and has moved the task to the Historical table. If the result is SUCS, ABRT, or ROLF, there will be a corresponding Grid Task Started audit message. The other results indicate that processing of this grid task never started.
GTST: Grid Task Started
This audit message indicates that the CMN service has started to process the specified grid task. The audit message immediately follows the Grid Task Submitted message for grid tasks initiated by the internal Grid Task Submission service and selected for automatic activation. For grid tasks submitted into the Pending table, this message is generated when the user starts the grid task.
GTSU: Grid Task Submitted
This audit message indicates that a grid task has been submitted to the CMN service.
LLST: Location Lost
This message is generated whenever a location for an object copy (replicated or erasure coded) cannot be found.
MGAU: Management audit message
The Management category logs user requests to the Management API. Every request that is not a GET or HEAD request to the API logs a response with the username, IP, and type of request to the API.
OLST: System Detected Lost Object
This message is generated when the DDS service cannot locate any copies of an object within the StorageGRID system.
ORLM: Object Rules Met
This message is generated when the object is successfully stored and copied as specified by the ILM rules.
OVWR: Object Overwrite
This message is generated when an external (client-requested) operation causes one object to be overwritten by another object.
SADD: Security Audit Disable
This message indicates that the originating service (node ID) has turned off audit message logging; audit messages are no longer being collected or delivered.
SADE: Security Audit Enable
This message indicates that the originating service (node ID) has restored audit message logging; audit messages are again being collected and delivered.
SCMT: Object Store Commit
Grid content is not made available or recognized as stored until it has been committed (meaning it has been stored persistently). Persistently stored content has been completely written to disk, and has passed related integrity checks. This message is issued when a content block is committed to storage.
SDEL: S3 DELETE
When an S3 client issues a DELETE transaction, a request is made to remove the specified object or bucket. This message is issued by the server if the transaction is successful.
SGET: S3 GET
When an S3 client issues a GET transaction, a request is made to retrieve an object or list the objects in a bucket. This message is issued by the server if the transaction is successful.
SHEA: S3 HEAD
When an S3 client issues a HEAD transaction, a request is made to check for the existence of an object or bucket and retrieve the metadata about an object. This message is issued by the server if the transaction is successful.
SPOS: S3 POST
When an S3 client issues a POST Object restore request, a request is made to restore an object from AWS Glacier storage to a Cloud Storage Pool. This message is issued by the server if the transaction is successful.
SPUT: S3 PUT
When an S3 client issues a PUT transaction, a request is made to create a new object or bucket. This message is issued by the server if the transaction is successful.
SREM: Object Store Remove
This message is issued when content is removed from persistent storage and is no longer accessible through regular APIs.
SUPD: S3 Metadata Updated
This message is generated by the S3 API when an S3 client updates the metadata for an ingested object. The message is issued by the server if the metadata update is successful.
SVRF: Object Store Verify Fail
This message is issued whenever a content block fails the verification process. Each time replicated object data is read from or written to disk, several verification and integrity checks are performed to ensure the data sent to the requesting user is identical to the data originally ingested into the system. If any of these checks fail, the system automatically quarantines the corrupt replicated object data to prevent it from being retrieved again.
SVRU: Object Store Verify Unknown
The LDR service’s Storage component continuously scans all copies of replicated object data in the object store. This message is issued when an unknown or unexpected copy of replicated object data is detected in the object store and moved to the quarantine directory.
SYSD: Node Stop
When a service is stopped gracefully, this message is generated to indicate the shutdown was requested. Typically this message is sent only after a subsequent restart, because the audit message queue is not cleared prior to shutdown. Look for the SYST message, sent at the beginning of the shutdown sequence, if the service has not restarted.
SYST: Node Stopping
When a service is gracefully stopped, this message is generated to indicate the shutdown was requested and that the service has initiated its shutdown sequence. SYST can be used to determine if the shutdown was requested, before the service is restarted (unlike SYSD, which is typically sent after the service restarts.)
SYSU: Node Start
When a service is restarted, this message is generated to indicate if the previous shutdown was clean (commanded) or disorderly (unexpected).
WDEL: Swift DELETE
When a Swift client issues a DELETE transaction, a request is made to remove the specified object or container. This message is issued by the server if the transaction is successful.
WGET: Swift GET
When a Swift client issues a GET transaction, a request is made to retrieve an object, list the objects in a container, or list the containers in an account. This message is issued by the server if the transaction is successful.
WHEA: Swift HEAD
When a Swift client issues a HEAD transaction, a request is made to check for the existence of an account, container, or object, and retrieve any relevant metadata. This message is issued by the server if the transaction is successful.
WPUT: Swift PUT
When a Swift client issues a PUT transaction, a request is made to create a new object or container. This message is issued by the server if the transaction is successful.