Reply
New Contributor
Posts: 3
Registered: ‎07-30-2015

Not able to see HDFS and HBase or Hive audit events on Navigatior

I am running CDH 5.4 with Navigator for 30 day trial period. In spite of removing all filters accept as default I am not able to audit events other than ones from cloud era manament service events.

Thanks
Venkat
Cloudera Employee
Posts: 13
Registered: ‎01-28-2014

Re: Not able to see HDFS and HBase or Hive audit events on Navigatior

Hi Venkat,

Are you accessing auditing from the "Audits" tab of CM at port 7180? Or are you accessing Navigator from port 7187?

As of a few releases ago, we moved Navigator's unified audit log out of CM and over to the Navigator user interface. You should be able to see all audit activity for HBase, Hive, HDFS and others by going to port 7187.
New Contributor
Posts: 3
Registered: ‎07-30-2015

Re: Not able to see HDFS and HBase or Hive audit events on Navigatior

[ Edited ]

Hi Mark,

 

First of all  many thanks for taking time to answer my query.  Yes I do use 7187 port of Navigator. On the file system I see audit events from HDFS and HBase.

Somehow its not appearing on Navigator.Navigator does see only change audit events from CM console in terms of

service restart/stop etc.

 

Further for your reference, for services I have configured following settings

 

1) HDFS Configuration Audit Event filter:No rules with Default action = accept

2) HBase configuration Audit Event filter:No rules with Default action = accept.

 

I see that Navigator metadata component is working properly and our cluster is enabled for Kerberos. I do see that now there is sub forum topic for Navigator.

If you can move this topic onto that one. It will be benefit community as well

 

Software version:Version: Cloudera Enterprise Data Hub Edition Trial 5.4.1 (#197 built by jenkins on 20150509-0042 git: 003e06d761f80834d39c3a42431a266f0aaee736)

 

Cheers

Venkat

 

 

 

Cloudera Employee
Posts: 8
Registered: ‎08-18-2015

Re: Not able to see HDFS and HBase or Hive audit events on Navigatior

Hi Venkat,

 

So the audit events pipeline works as follows:

 

For storage:

HDFS/Hive/HBase -> Log audit event to /var/log/<service_name>/audits -> CM Agent -> Audit Server -> Database

 

For display:

Database -> Audit Server -> CM Server -> Navigator Sever

 

As a first step to figure out where problem lies (storage or display), can you please look into audit database and check if audit events are there.

 

Based on that we can take look at different logs to check wehre things may be going wrong. Also with 5.4.1 we had a known issue with audit of

Navigator Metadata Server (NMS) itself. Is it possible for you to upgrade to 5.4.3? Otherwise, please disable auditing of NMS server from CM UI.

Announcements
New solutions