https://community.cloudera.com/t5/Archives-of-Support-Questions/HDFS-audit-log/m-p/164420#M53697 <P>Is there a reason why there is a forward slash "/" in the "ip" field in front of the real IP Address in hdfs-audit.log?</P><P>2017-01-27 00:00:01,300 INFO FSNamesystem.audit: allowed=true ugi=SOMETHING.COM (auth:KERBEROS) ip=<STRONG>/</STRONG>172.22.7.129 cmd=listStatus src=/apps/hbase/data/archive/data/default/ambarismoketest dst=null perm=null proto=rpc callerContext=CLI</P> Fri, 16 Sep 2022 11:02:19 GMT sbmaillist 2022-09-16T11:02:19Z https://community.cloudera.com/t5/Archives-of-Support-Questions/HDFS-audit-log/m-p/164420#M53697 <P>Is there a reason why there is a forward slash "/" in the "ip" field in front of the real IP Address in hdfs-audit.log?</P><P>2017-01-27 00:00:01,300 INFO FSNamesystem.audit: allowed=true ugi=SOMETHING.COM (auth:KERBEROS) ip=<STRONG>/</STRONG>172.22.7.129 cmd=listStatus src=/apps/hbase/data/archive/data/default/ambarismoketest dst=null perm=null proto=rpc callerContext=CLI</P> Fri, 16 Sep 2022 11:02:19 GMT https://community.cloudera.com/t5/Archives-of-Support-Questions/HDFS-audit-log/m-p/164420#M53697 sbmaillist 2022-09-16T11:02:19Z https://community.cloudera.com/t5/Archives-of-Support-Questions/HDFS-audit-log/m-p/164421#M53698 <P>Very good question! Let's dig into Hadoop's source to find this out.</P><P>The audit log uses java.net.InetAddress's toString() method to obtain a text format of the address:</P><P><A href="https://github.com/apache/hadoop/blob/trunk/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java#L7049" target="_blank">https://github.com/apache/hadoop/blob/trunk/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java#L7049</A></P><P>InetAddress's returns the information in "hostname/ip" format. If the hostname is not resolvable (reverse lookup is not working) then you get a starting slash:</P><P><A href="http://docs.oracle.com/javase/7/docs/api/java/net/InetAddress.html#toString()" target="_blank">http://docs.oracle.com/javase/7/docs/api/java/net/InetAddress.html#toString()</A></P> Wed, 08 Feb 2017 13:53:29 GMT https://community.cloudera.com/t5/Archives-of-Support-Questions/HDFS-audit-log/m-p/164421#M53698 tkiss 2017-02-08T13:53:29Z