audit.config

Type: object

Type: array
No Additional Items

AuditEntry

Type: object
No Additional Properties

Id

Type: integer

Retention

Type: integer

Number of days to retain local audit messages.

Value must be greater or equal to 1 and lesser or equal to 30

Reservation

Type: integer

Size in GiB of refreservation to set on ZFS dataset where the audit databases are stored. The refreservation
specifies the minimum amount of space guaranteed to the dataset, and counts against the space available for other
datasets in the zpool where the audit dataset is located.

Value must be greater or equal to 0 and lesser or equal to 100

Quota

Type: integer

Size in GiB of the maximum amount of space that may be consumed by the dataset where the audit dabases are
stored.

Value must be greater or equal to 0 and lesser or equal to 100

Quota Fill Warning

Type: integer

Percentage used of dataset quota at which to generate a warning alert.

Value must be greater or equal to 5 and lesser or equal to 80

Quota Fill Critical

Type: integer

Percentage used of dataset quota at which to generate a critical alert.

Value must be greater or equal to 50 and lesser or equal to 95

Remote Logging Enabled

Type: boolean

Boolean indicating whether logging to a remote syslog server is enabled on TrueNAS and if audit logs are
included in what is sent remotely.

AuditEntrySpace

Type: object

ZFS dataset properties relating space used and available for the dataset where the audit databases are
written.

 No Additional Properties

Used

Type: integer

Used By Dataset

Type: integer

Used By Reservation

Type: integer

Used By Snapshots

Type: integer

Available

Type: integer

AuditEntryEnabledServices

Type: object

JSON object with key denoting service, and value containing a JSON array of what aspects of this service are
being audited. In the case of the SMB audit, the list contains share names of shares for which auditing is
enabled.

 No Additional Properties

Middleware

Type: array
No Additional Items
Each item of this array must be:
Type: object

Smb

Type: array
No Additional Items
Each item of this array must be:
Type: object

Sudo

Type: array of string
No Additional Items
Each item of this array must be:
Type: string


Required roles: SYSTEM_AUDIT_READ