I do it this way with sucess:

/opt/novell/vigil/bin/vlog --blockNssEventsOfVol VOL1 --pattern "+VOL1:/PATH/** (*)" --format CSV -o <Path and file for the output>  -d

Tried not to use filter file, no change

/opt/novell/vigil/bin/vlog --blockNssEventsOfVol DATA --pattern ":-roll -user_stop -user_start" --pattern "+DATA:/** (ADDTRUSTEE REMOVETRUSTEE SETINHERITEDRIGHTS)" --format CEF

Can your command work to -- format CSV to separate out the CSV vs CEF part of it?

Still not working. I will open a ticket.

P.S. I removed the filter pattern and I'm getting now events, looks like the pattern is the problem part.

Yes, you have several things you are trying to focus on with those patterns.  If time was endless, the trial and error approach might get you there.  The first --pattern part (and that you could have two --pattern parts) is not one I am familiar with from my limited use of vlog to date, so it would be my first part to remove in any testing.

Yes, you have several things you are trying to focus on with those patterns.  If time was endless, the trial and error approach might get you there.  The first --pattern part (and that you could have two --pattern parts) is not one I am familiar with from my limited use of vlog to date, so it would be my first part to remove in any testing.