For DesiredAccess, refer to the following documentation from Microsoft  [URL] FILE_READ_DATA 0x00000001 FILE_WRITE_DATA 0x00000002 FILE_APPEND_DATA 0x00000004 FILE_READ_EA 0x00000008 FILE_WRITE_EA 0x00000010 FILE_EXECUTE 0x00000020 FILE_READ_ATTRIBUTES 0x00000080 FILE_WRITE_ATTRIBUTES 0x00000100 DELETE 0x00010000 READ_CONTROL 0x00020000 WRITE_DAC 0x00040000 WRITE_OWNER 0x00080000 SYNCHRONIZE 0x00100000 ACCESS_SYSTEM_SECURITY 0x01000000 MAXIMAL_ACCESS 0x02000000 GENERIC_ALL 0x10000000 GENERIC_EXECUTE 0x20000000 GENERIC_WRITE 0x40000000 GENERIC_READ 0x80000000  So for a DesiredAccess of 128 which is hex 0x00000080  So that corresponds to FILE_READ_ATTRIBUTES
Does anyone know of a document that outlines the events generated by OneFS protocol auditing?  I am trying to make sense of the events, but haven't been able to find anything that explains the various sections.  I am currently only auditing failures for create, delete, read, rename, and set_security.  Below is an example audit entry, which must be a failure because I am not auditing success entries.  It does say "DOES_NOT_EXISTS", so I would probably assume that is a failure even if I were auditing success events as well, but is there a way to tell?  How are the success vs failure audits determined, I don't see anything that says one way or another.  In theparticular event below, I see it is a create event, so according to the docs, it is either a create file/fold, open file/folder, or a share mount operation.  Is there a way to determine which of those operations were performed?    Is there a place to reference the desiredAccess, createDispo, and ntStatus values?  Any info is greatly appreciated.  [IMAGE]
OneFS audit log entries