I have the same/related question: what is the default logging level for logging user-issued 'hdfs dfs' commands? Does the system log all those commands by default? Where would I look to see what the logging level actually is? Thanks.
If you are using CDH:
- (without Navigator Audit Server) by default, audits are stored in /var/log/hadoop-hdfs/hfds-audit.log
- (With Navigator Audit Server), audits are stored in /var/log/hadoop-hdfs/audits/
This page has a list of auditable events: