> For the complete documentation index, see [llms.txt](https://docs.weka.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.weka.io/5.1/operation-guide/audit-and-forwarding-management/manage-audit-and-forwarding-using-the-cli.md). # Manage audit and forwarding using the CLI You can use the `weka audit` commands to configure and manage the audit and forwarding feature. The commands are organized into the following groups: * `weka audit cluster`: Manage audit settings at the cluster level. * `weka audit fs`: Manage audit settings for specific filesystems. ## Manage cluster-level auditing Use the `weka audit cluster` commands to control the audit feature for the entire cluster. ### **Enable or disable cluster-wide auditing** The auditing functionality is disabled by default. Enable it at the cluster level before you can configure auditing for specific filesystems. This initial enablement sets up the necessary infrastructure and components required for the audit system to function. * To enable: ``` weka audit cluster enable ``` * To disable: ``` weka audit cluster disable ``` ### **View cluster audit status** View the current cluster-wide status of the audit feature. ``` weka audit cluster status ``` ### **View cluster audit statistics** View detailed statistics about the audit logs for the entire cluster. ``` weka audit cluster stats ``` ### **Set the global audit operations** Defines the global default policy for which categories of operations are audited across the cluster. This policy applies to all filesystems but can be overridden by settings on an individual filesystem. You can choose to audit `all` categories or specify a subset (for example, `read`, `delete`). ``` weka audit cluster set-global-operations []... ``` **Parameter**
NameDescription
operations*

A space-separated list of operation categories to audit. Providing a new list replaces any previously set global operations.

Values: all, none, open, create, read, modify, delete, rename, close, sessionmanagement.

### **Manage full path resolution** Use the following commands to control the asynchronous process that adds full file paths to audit events. Including full paths provides valuable context for each operation but may introduce a performance impact. Disabling this feature can increase event throughput if the path information is not required for your use case. * To enable resolution of full file paths in forwarded audit events: ``` weka audit cluster resolve-paths enable ``` * To disable the resolution of full file paths in forwarded audit events.: ``` weka audit cluster resolve-paths disable ``` ## Manage filesystem-level auditing Use the `weka audit fs` commands to control audit settings for individual filesystems. ### **View filesystem audit status** List the audit status for all filesystems or a specific filesystem. ``` weka audit fs status [--name name] ``` **Parameter**
NameDescription
nameThe name of a specific filesystem to view.
### **Enable or disable auditing for a filesystem** Enable or disable auditing on a specific filesystem. * To enable: ``` weka audit fs enable ``` * To disable: ``` weka audit fs disable ``` **Parameter**
NameDescription
name*The name of the filesystem on which to enable or disable auditing.
**Related topics** [Manage filesystems using the GUI](/5.1/weka-filesystems-and-object-stores/managing-filesystems/managing-filesystems.md) [Manage filesystems using the CLI](/5.1/weka-filesystems-and-object-stores/managing-filesystems/managing-filesystems-1.md) ### **Set audit operations for a specific filesystem** Override the global audit settings and define a specific set of operations to audit for an individual filesystem. ``` weka audit fs set-operations []... ``` **Parameters**
NameDescription
name*The name of the filesystem to configure.
operations*

A space-separated list of operation categories to audit. This list replaces any previously set operations for this filesystem.

Possible values: all, none, open, create, read, modify, delete, rename, close, sessionmanagement.

## View telemetry export health Use the following command to check whether each export delivers audit events from every container: `weka telemetry exports status [--containers] [--check]` The output shows one row per export: * **Reporting:** the number of containers delivering events, out of those expected. For example, `24/24`. * **Problems:** what is wrong on the other containers. For example, `2 stalled, 1 container down`. * **Health:** one of the following values. | Health | Meaning | | --------------- | ---------------------------------------------------------------- | | `OK` | Every expected container delivers events. | | `DEGRADED` | Some containers deliver events and others report a problem. | | `DOWN` | No container delivers events, and at least one reports an error. | | `PENDING` | No container delivers events yet, and none reports an error. | | `DISABLED` | The export is disabled. | | `TELEMETRY OFF` | The export is enabled, but telemetry is off in the cluster. | **Parameters** | Name | Description | | -------------- | ------------------------------------------------------------------------------------------------------------------ | | `--containers` | Shows one row per container instead of one row per export. | | `--check` | Exits with code `2` when any export shown is `DOWN`, `DEGRADED`, or `TELEMETRY OFF`. Use it in monitoring scripts. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.weka.io/5.1/operation-guide/audit-and-forwarding-management/manage-audit-and-forwarding-using-the-cli.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.