HDFS audit log

[#1]

Is there a reason why there is a forward slash "/" in the "ip" field in front of the real IP Address in hdfs-audit.log?

2017-01-27 00:00:01,300 INFO FSNamesystem.audit: allowed=true ugi=SOMETHING.COM (auth:KERBEROS) ip=/172.22.7.129 cmd=listStatus src=/apps/hbase/data/archive/data/default/ambarismoketest dst=null perm=null proto=rpc callerContext=CLI

[#2 · Accepted solution]

Very good question! Let's dig into Hadoop's source to find this out.

The audit log uses java.net.InetAddress's toString() method to obtain a text format of the address:

https://github.com/apache/hadoop/blob/trunk/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache...

InetAddress's returns the information in "hostname/ip" format. If the hostname is not resolvable (reverse lookup is not working) then you get a starting slash:

http://docs.oracle.com/javase/7/docs/api/java/net/InetAddress.html#toString()