Globus Connect Server Audit Query

Name

globus-connect-server audit query - Search and filter the high assurance audit log database

Synopsis

globus-connect-server audit query [OPTIONS]…​

Description

The globus-connect-server audit query command allows searching the audit log database using various filters. The audit log database is created and populated with the command globus-connect-server audit load.

Important
You must have read access to the database specified by the --db-path option.

Options

-h, --help

Show help message and exit.

--version

Show the version and exit.

-d, --db-path PATH

Path of the audit log database. The default is ~/.globus/audit-logs.db.

-F, --format "text" | "json" | "csv"

Output format. The default format is text. Supported values are text, json, or csv.

-p, --path PATH

Query by storage path accesses. To query a partial path, add % on either or both ends. Only results related to accessing this path will be returned.

-i, --identity ID

Query by identity. Accepts a Globus identity uuid. Only results that were initiated by this identity will be returned.

-u, --user USERNAME

Query by storage or local username. Only operations initiated by this user will be returned.

-c, --collection UUID

Filter by collection id. Can be passed multiple times.

-t, --task-id UUID|none

Filter by task id. Can be passed multiple times.

-o, --op OP

Filter by operation type. Can be passed multiple times. Possible values are STOR, RETR, STAT, CKSM, DELE, REN, MKD, RMD, RDEL. See operations.

-S, --start-date DATE

Starting date for queries, formatted year-month-day (e.g. 2020-05-29). Only results that occur on or after this day will be returned.

-E, --end-date DATE

Ending date for queries, formatted year-month-day (e.g. 2020-05-29). Only results that occur on or before this day will be returned.

-f, --field FIELD

Select the fields returned with each result. Can be passed multiple times. Possible values are start_ts, end_ts, op, path, peer_addr, length, result, count, client_addr, auth_type, process_user, storage_user, root_path, task_id, collection_id, identity_id. See schema.

Examples

Find all downloads from a partial path:

globus-connect-server audit query -o RETR -p /data/research/%

  1. after a particular date:

globus-connect-server audit query -o RETR -p /data/research/% -S 2021-02-16

  1. output in JSON format:

globus-connect-server audit query -o RETR -p /data/research/% -S 2021-02-16 -F json