There are two glaring issues with the accuracy of audit replay:
deletes are currently specified as non-recursive. If a delete was originally submitted as non-recursive but performed on a non-empty directory, it would have failed, and not appeared in the audit log in the first place. Since all deletes in the audit log succeeded, we should simply specify all of our deletes as recursive.
Large listStatus calls are amplified. When a large listing is broken up into several separate RPCs, each one is logged in the audit log. However, we currently perform a full listing for each entry in the audit log, so e.g. if a large listing produced 5 RPCs, in the Dynamometer replay we would perform 25 RPCs, since for each entry in the audit log we would do a full listing and produce an additional 5 RPCs.
There are two glaring issues with the accuracy of audit replay: