A method, article of manufacture, and apparatus for analyzing a distributed file system is discussed. A metadata operation is captured in an audit log, wherein the metadata operation is on an object stored in the distributed file system. An event is pushed to a distributed commit log and a real-time analytics engine in response to capturing the metadata operation. The event is persistently stored in the distributed commit log.