Audit Message Workflows

Introduction

This page shows the audit messages you can expect for typical file actions. Use it to validate that auditing works end to end, and as a reference when you build applications that consume user file access events.

The workflows below cover tested file actions with Turbo Audit enabled, which is the default configuration. In every example, ..\parent_dir\dir_name\file_name stands for the path of the object the user acted on.

note

Some of the event types shown here, such as FILE_CLOSE, DIR_OPEN, and DIR_CLOSE, are not stored in the audit database. See Excluded audit events.

SMB workflows with Turbo Audit

Create a file

S_FILE_CREATE ..\parent_dir\desktop.ini
FILE_CLOSE_MODIFIED ..\parent_dir\dir_name\file_name
FILE_WRITE ..\parent_dir\dir_name\file_name
DIR_CLOSE ..\parent_dir\
DIR_OPEN ..\parent_dir\
FILE_CREATE ..\parent_dir\dir_name\file_name

Rename a file

S_FILE_CREATE ..\parent_dir\desktop.ini
DIR_CLOSE ..\parent_dir\
FILE_CLOSE ..\parent_dir\dir_name\file_name
FILE_RENAME ..\parent_dir\dir_name\file_name
DIR_OPEN ..\parent_dir\
FILE_CLOSE ..\parent_dir\dir_name\file_name

Write to a file

FILE_CLOSE_MODIFIED ..\parent_dir\dir_name\file_name
FILE_WRITE ..\parent_dir\dir_name\file_name
DIR_CLOSE ..\parent_dir\
DIR_OPEN ..\parent_dir\
FILE_READ ..\parent_dir\dir_name\file_name
FILE_OPEN_WRITE ..\parent_dir\dir_name\file_name
FILE_CLOSE ..\parent_dir\dir_name\file_name
DIR_CLOSE ..\parent_dir\
DIR_OPEN ..\parent_dir\
FILE_READ ..\parent_dir\dir_name\file_name
FILE_OPEN_WRITE ..\parent_dir\dir_name\file_name

Delete a file

S_FILE_CREATE ..\parent_dir\desktop.ini
FILE_CLOSE ..\parent_dir\dir_name\file_name
FILE_DELETE ..\parent_dir\dir_name\file_name
DIR_CLOSE ..\parent_dir\
DIR_OPEN ..\parent_dir\

Create a folder

S_FILE_CREATE ..\parent_dir\desktop.ini
DIR_CLOSE ..\parent_dir\dir_name\new_dir_name
DIR_CREATE ..\parent_dir\dir_name\new_dir_name

Delete a folder

S_FILE_CREATE ..\parent_dir\desktop.ini
DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_DELETE ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name

Rename a folder

S_FILE_CREATE ..\parent_dir\desktop.ini
DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_RENAME ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name

Set the ACL of a file

FILE_CLOSE ..\parent_dir\dir_name\file_name
FILE_SET_ACL ..\parent_dir\dir_name\file_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name

Set the ACL of a directory

DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name
DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name
DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name
DIR_SET_ACL ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name
DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name
DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name
DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
S_FILE_CREATE ..\parent_dir\desktop.ini
DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_CREATE ..\parent_dir\dir_name\current_dir_name

A user with a read-only ACL opens a file

FILE_CLOSE ..\parent_dir\dir_name\file_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
FILE_CLOSE ..\parent_dir\dir_name\file_name
FILE_OPEN_NOACCESS ..\parent_dir\dir_name\file_name
FILE_CLOSE ..\parent_dir\dir_name\file_name
FILE_OPEN_NOACCESS ..\parent_dir\dir_name\file_name
FILE_CLOSE ..\parent_dir\dir_name\file_name
FILE_OPEN_NOACCESS ..\parent_dir\dir_name\file_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
FILE_OPEN_NOACCESS ..\parent_dir\dir_name\file_name
FILE_CLOSE ..\parent_dir\dir_name\file_name
DIR_OPEN ..\parent_dir\dir_name
FILE_CLOSE ..\parent_dir\dir_name\file_name
FILE_OPEN_NOACCESS ..\parent_dir\dir_name\file_name
FILE_CLOSE ..\parent_dir\dir_name\file_name
FILE_OPEN_NOACCESS ..\parent_dir\dir_name\file_name
FILE_OPEN_READ ..\parent_dir\dir_name\file_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
S_FILE_CREATE ..\parent_dir\dir_name\desktop.ini

NFS workflows with Turbo Audit

Create a file

DIR_CLOSE ..\parent_dir\dir_name
FILE_CLOSE_MODIFIED ..\parent_dir\dir_name\file_name
FILE_WRITE ..\parent_dir\dir_name\file_name
FILE_CLOSE ..\parent_dir\dir_name\file_name
FILE_CREATE ..\parent_dir\dir_name\file_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name

Rename a file

DIR_CLOSE ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
FILE_RENAME ..\parent_dir\dir_name\file_name
DIR_OPEN ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name

Write to a file

The following sequence was captured while editing a file with a text editor, so it also includes the editor's temporary and swap files (.swp, .swx, and a trailing ~ backup).

DIR_CLOSE ..\parent_dir\dir_name
FILE_DELETE ..\parent_dir\dir_name\file_name.swp
FILE_DELETE ..\parent_dir\dir_name\file_name~
FILE_CLOSE ..\parent_dir\dir_name\file_name
FILE_CLOSE_MODIFIED ..\parent_dir\dir_name\file_name
FILE_SET_ACL ..\parent_dir\dir_name\file_name
FILE_WRITE ..\parent_dir\dir_name\file_name
FILE_CLOSE ..\parent_dir\dir_name\file_name
FILE_CREATE ..\parent_dir\dir_name\file_name
DIR_CLOSE ..\parent_dir\dir_name
FILE_RENAME ..\parent_dir\dir_name\file_name
DIR_OPEN ..\parent_dir\dir_name
FILE_DELETE ..\parent_dir\dir_name\tempfile
FILE_SET_ACL ..\parent_dir\dir_name\tempfile
FILE_CLOSE ..\parent_dir\dir_name\tempfile
FILE_SET_ACL ..\parent_dir\dir_name\tempfile
FILE_CLOSE ..\parent_dir\dir_name\tempfile
FILE_CLOSE ..\parent_dir\dir_name\tempfile
FILE_CREATE ..\parent_dir\dir_name\tempfile
FILE_CLOSE_MODIFIED ..\parent_dir\dir_name\file_name.swp
FILE_CLOSE ..\parent_dir\dir_name\file_name.swp
FILE_SET_ACL ..\parent_dir\dir_name\file_name.swp
FILE_WRITE ..\parent_dir\dir_name\file_name.swp
FILE_CLOSE ..\parent_dir\dir_name\file_name.swp
FILE_SET_ACL ..\parent_dir\dir_name\file_name.swp
FILE_CLOSE ..\parent_dir\dir_name\file_name.swp
FILE_CREATE ..\parent_dir\dir_name\file_name.swp
FILE_DELETE ..\parent_dir\dir_name\file_name.swp
FILE_DELETE ..\parent_dir\dir_name\file_name.swx
FILE_CLOSE ..\parent_dir\dir_name\file_name.swx
FILE_SET_ACL ..\parent_dir\dir_name\file_name.swx
FILE_CLOSE ..\parent_dir\dir_name\file_name.swx
FILE_CREATE ..\parent_dir\dir_name\file_name.swx
FILE_CLOSE ..\parent_dir\dir_name\file_name.swp
FILE_SET_ACL ..\parent_dir\dir_name\file_name.swp
FILE_CLOSE ..\parent_dir\dir_name\file_name.swp
FILE_CREATE ..\parent_dir\dir_name\file_name.swp
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
FILE_CLOSE ..\parent_dir\dir_name\file_name
FILE_CLOSE ..\parent_dir\dir_name\file_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name

Delete a file

DIR_CLOSE ..\parent_dir\dir_name
FILE_DELETE ..\parent_dir\dir_name\file_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name

Create a folder

DIR_CLOSE ..\parent_dir\dir_name\new_dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_CREATE ..\parent_dir\dir_name\new_dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name

Delete a folder

DIR_CLOSE ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_DELETE ..\parent_dir\dir_name\current_dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name
DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name

Rename a folder

DIR_CLOSE ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_RENAME ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_OPEN ..\parent_dir\dir_name

Modify the ACL of a file

DIR_CLOSE ..\parent_dir\dir_name
FILE_CLOSE ..\parent_dir\dir_name\file_name
FILE_SET_ACL ..\parent_dir\dir_name\file_name
FILE_CLOSE ..\parent_dir\dir_name\file_name
DIR_OPEN ..\parent_dir\dir_name

Modify the ACL of a directory

DIR_CLOSE ..\parent_dir\dir_name\current_dir_name
DIR_CLOSE ..\parent_dir\dir_name
DIR_SET_ACL ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name\current_dir_name
DIR_OPEN ..\parent_dir\dir_name

See also

• Ransomware Audit Events Required — The audit events that must be enabled, and the event types excluded from storage.
• Data Auditing — Search and report on the audit events collected from your clusters.
• Audit Event Forwarding — Forward the raw audit event stream to a syslog server or S3.