VAST Management System Scenario: Solving for “Who Deleted A File”

This video from VAST Data Customer Education walks through a common administrative scenario: a user reports a missing file. For storage administrators and operators, this tutorial demonstrates how to use the powerful auditing capabilities within the VAST Management System (VMS) to quickly and accurately determine the file’s fate. The demonstration shows how VAST’s auditing features, when enabled, can be leveraged to track file system events. We recreate a situation where a file named cheese.txt is reported as missing, and then we use the built-in auditing tools to investigate. The tutorial highlights the process of querying the audit logs to find specific events. By writing a targeted query for a rename operation on the file’s path, we are able to:

• Identify the specific user who performed the action.

• See the protocol used (NFSv4).

• Discover the file’s new location, revealing that it was not deleted, but rather moved to another directory.

This process is shown to be highly effective and fast, providing a definitive answer to a common user support request. The video also touches upon how this type of query can be executed from an external query engine like Trino, underscoring the flexibility of VAST’s auditing data. This scenario-based tutorial is designed to equip VAST Data operators with a practical use case for VMS auditing, enabling them to troubleshoot and resolve issues related to file management and user activity with confidence.