Atlas ranger audits being logged in spool

[#1]

My solr service is up and runing, but still all the ranger audits for atlas service are being loaded into /var/log/atlas/audit/spool/archive which ideally is done when the solr-sink is down for that service. It is causing a lot of space consumption rapidly please help!

[#2]

Hi, @hadoopranger spool directory can start filling when the ranger plugin for Atlas or any service is not working properly, please check the Rangers plugin status page if the plugins are getting synced or not.

Ranger -> Audit -> Plugin Status -> cm_atlas (see if you have any orange color warning symbol under this)

[#3]

Hi Rajat,

Thanks for the reply yes for atlas ranger plugin am able to see a orange alert which says policy is updated but not yet synced , is there a way to get rid of this

@Rajat_710 

[#4]

@hadoopranger you can check the atlas application.log file for why atlas is not able to pull the ranger policies and create a cache, also just restart atlas with the below command to verify the error and if the ranger plugin is working fine or not.

# grep application.log | grep -i "ranger.plugin"

[#5]

Nope no errors related to ranger plugin in atlas logs, restarted the atlas as well

[#6]

@hadoopranger check the same ranger UI page for that orange mark on the cm_atlas plugin.

[#7]

I do not see any orange alerts but still the audit logs for ranger are being written into spool directory