Audit trail for HDFS data use

[#1]

I have the same/related question: what is the default logging level for logging user-issued 'hdfs dfs' commands?  Does the system log all those commands by default?  Where would I look to see what the logging level actually is?  Thanks.

[#2]

@davids30,

What, exactly, are you trying to track?  Are you trying to generate audit information for HDFS access?

[#3]

Trying to track how a user interacted with HDFS for compliance reasons. What files were accessed, what hdfs commands were issued, and when.

Thanks

[#4]

@davids30,

If you are using CDH:

- (without Navigator Audit Server) by default, audits are stored in /var/log/hadoop-hdfs/hfds-audit.log

- (With Navigator Audit Server), audits are stored in /var/log/hadoop-hdfs/audits/

This page has a list of auditable events:

https://www.cloudera.com/documentation/enterprise/6/6.0/topics/cn_audit_event_reference.html#operati...

[#5]

thanks!