Does Apache ranger has REST API to fetch Audit data?

[#1]

Hi Everyone,

I want to fetch audit data of apache ranger by using REST API.specially,wants to fetch data of access tab.

so does apache ranger support such REST API call?

Please find attachment.I have shown which data I really want to get.apache-ranger-audit-tab.png

Thanks in advance.

[#2 · Accepted solution]

@Manoj Dhake

It sounds like you want to pull out a lot of data, so I would definitely not use Ranger's RestAPI (not even sure Ranger allows audit export via RestAPI). If you are using DB Audits, which we do not recommend in production systems, you can connect and fetch data from DB.

Pls refer more on - https://community.hortonworks.com/questions/3115/ranger-audit-custom-reports.html

[#3 · Accepted solution]

@Manoj Dhake

It sounds like you want to pull out a lot of data, so I would definitely not use Ranger's RestAPI (not even sure Ranger allows audit export via RestAPI). If you are using DB Audits, which we do not recommend in production systems, you can connect and fetch data from DB.

Pls refer more on - https://community.hortonworks.com/questions/3115/ranger-audit-custom-reports.html

[#4]

Thank you sagar,

Did you mean i need pull audit data from ranger audit database.

If i am correct then ,how to do this activity?

Or do we have another approach to pull audit data?

[#5]

Pulling data from ranger audit which can be manually task/script needed.

But as per @Ramesh Mani mentioned you can have solr installed and configure in cluster through which you can access ranger audits via rest api.

[#6]

@Manoj Dhake

Audit is stored in solr and you can access it via solr apis

e.g

curl http://hostname:6083/solr/ranger_audits/query -d 'q=*:*&fq=reqUser:user1&wt=json&indent=on'

curl --negotiate -vis -u : http://hostname:6083/solr/ranger_audits/query -d 'q=*%3A*&fq=repoType%3A8&sort=evtTime+desc&start=0&rows=25

Check out various solr apis for searching data

[#7 · Accepted solution]

@ManusUse the below Ranger rest API to fetch the audit logs :

curl -v --insecure --anyauth --user username:password -H "Accept: application/json" -H "Content-Type: application/json" -X GET https://RANGER_HOST:6182/service/assets/accessAudit