question Ranger audit log is empty .... although policy is applied in Archives of Support Questions (Read Only)

Ranger audit log is empty .... although policy is applied

geko — Wed, 23 Mar 2016 22:45:02 GMT

Hello,

I have a fresh installation of HDP2.2.4 including Ranger 0.4

After enabling and configuring HDFS policy, that policy is getting applied, but I have no entries in the Audit=>Access tab of Ranger UI, it is empty, even after waiting for some minutes and triggering several actions. In the Audit=>Agents tab I can see all the HDFS/Hive/HBase agents connected.

Where can I check for issues what is going wrong here ?

Thanks...

Re: Ranger audit log is empty .... although policy is applied

jstraub — Wed, 23 Mar 2016 23:58:54 GMT

Make sure the Audit Source is set to DB in Ambari (see Ranger configuration). Also could you check if the database (mysql?) contains any audit entries?

Re: Ranger audit log is empty .... although policy is applied

geko — Mon, 19 Aug 2019 08:16:35 GMT

Hi @Jonas Straub , thanks for answering.

yep, audit-to-db is marked in HDFS Ranger plugin config, I checked MySQL directly as user 'rangeradmin', but the table xa_access_audit is empty.

These are the settings for Ranger MySQL in Ambari =>

Re: Ranger audit log is empty .... although policy is applied

rmani — Thu, 24 Mar 2016 02:21:14 GMT

@Gerd Koening. Check in Ranger -> Config > Advanced ranger-admin-site ranger.audit.source.type = db

Do you see any exception in namenode log related to Ranger Auditing? Also check that the policy is having the audit enabled. Also hdfs operation you are doing should be for the resources which are in the Policy.

Re: Ranger audit log is empty .... although policy is applied

geko — Thu, 24 Mar 2016 15:37:58 GMT

hi @Ramesh Mani , many thanks.

In my Ambari version(2.1.2.1, Ranger 0.4, HDP2.2.4)) I cannot find that property in Ranger config. There is just "advanced ranger-site" but also there, no property "ranger.audit.source.type".

The only place where I can configure where to log, is the Policy configuration itself, like in HDFS=>advanced ranger-hdfs-plugin-configuration" where I clicked/marked the checkbox "Audit to DB"

The namenode log seems to be the correct hint, there I saw db errors like "connection refused", so I have to investigate into that. I think it is more a mysql problem now, not really a ranger issue....I will catchup on this after after the long weekend...

Re: Ranger audit log is empty .... although policy is applied

geko — Sat, 26 Mar 2016 17:34:01 GMT

Hi @Jonas Straub , Hi @Ramesh Mani ,

I just wanted to update with the solution of that issue. At the end it turned out, that after Ambari upgrade (from 2.0.1 initially to Ambari 2.1.2.1), the placeholder-variables were not set/applied correctly via Ambari. In HDFS => advanced ranger-plugin config there were variables like {{xaaudit_db_XYZ}}, and I replaced those with their real values (xaaudit.db.username, xaaudit.db.database, xaaudit.db.password, ...) , restarted HDFS and now the audit log entries are being written.

Regards, Gerd