question Re: Range Audit Page - No Data for Report in Archives of Support Questions (Read Only)

Range Audit Page - No Data for Report

sushil61 — Sun, 10 Jan 2016 06:27:42 GMT

We have HDP 2.3 with Ranger. Audit data store is MySQL DB. The audit transactions are getting stored in ranger_audit db. But the Ranger Audit page on ranger admin portal did not showing any record. We are also trying to store log to HDFS/ranger/audit folder, but these also not getting recorded.

Re: Range Audit Page - No Data for Report

rmani — Sun, 10 Jan 2016 06:43:08 GMT

Which Ranger Plugin for which audit is getting logged? Please check if there is Ranger Policy for auditing the resource for the Hadoop component you are auditing. In Ambari for Ranger service check in Config check property Advanced-Ranger-admin-site> "ranger.audit.source.type" . This should be set to "db"

Please check this also for details

http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.2/bk_Ranger_Install_Guide/content/ranger_database_settings.html

Re: Range Audit Page - No Data for Report

sushil61 — Mon, 11 Jan 2016 03:36:28 GMT

HDFS ranger plugin audit is getting logged in Ranger_Audit DB. Yes,HDFS resource access/denied audit is being audited and recorded in MySQL ranger_audit DB. We have verified from the xa_access.. table. Yes,the ranger.audit.source.type is set to db in advance-ranger-admin-site. Still the audit page is not displaying any transactions.

Re: Range Audit Page - No Data for Report

abajwa — Mon, 11 Jan 2016 04:16:03 GMT

In the Ranger audits page, try removing the default filter (for the current days audits). Sometimes if there is a time mismatch you won't see any audits in Ranger by default, but after clearing this filter they appear

Re: Range Audit Page - No Data for Report

sushil61 — Tue, 12 Jan 2016 00:24:04 GMT

source type is setup by default to 'solr'. I changed it to 'db' and also, remove the filter. And it works!!!!.

The Solr os a preferabl and the recommended audit source type but unfortunately it is not included in the Ambari 2.1 stack.

Thanks for the support.

Re: Range Audit Page - No Data for Report

abajwa — Tue, 12 Jan 2016 01:18:38 GMT

Thanks for letting us know. Solr is included with HDP Search with HDP 2.3. You install from repo using instructions here:

https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.0/bk_search/index.html

The official Solr stack service for Ambari is on the roadmap. Until then, for test/dev envs you can use one of these (not for use in prod envs):

https://github.com/LucidWorks/solr-stack

https://github.com/abajwa-hw/solr-stack