10-02-2017 04:27 AM
Dear sir / madam,
Our cloudera versiion is 5.7.2 with Navigator and the metadata database is Postgresql. We are facing a problem about the metadata database goes full very quickly. I did query the metadata database and found that the event about OPEN got more than 48,542,073 records per day. (select ip_addr, operation, count(*) as C from hdfs_audit_events_2017_10_02 group by ip_addr, operation order by C;). Therefore is there any way to not log about OPEN event in Navigator please?
(Here the OPEN event is about open file, NOT open connection; there are the other events such as "create", "rename", "delete" and more)
10-02-2017 08:13 AM - edited 10-02-2017 08:14 AM
You can achieve that via setting up rules for "Audit Event Filter" according to Configuring Service Auditing Properties. Please note that the audit events discarded this way will never reach the Cloudera Navigator database, because of that you'll have no way to review them in the future.
Let me know if that helps.
10-02-2017 10:55 AM
Thank you so much for your kind help! I believe your method will work perfectly. I will implement it tomorrow and report to you the result within this week due to that the admin team might want to observe several days.