Configuring Apache Ranger to send Syslog to a SIEM system via log4j Syslog appender

[#1]

Hi,

I've been trying to configure Ranger to send its audit logs via Syslog to our SIEM system. I'd rather avoid storing to Solr and HDFS, which then forces me to query on regular basis in a rather complex production environment. And since Syslog is most common way to transfer audit events to a SIEM system, I've been digging into Log4j Appenders and found that there is a indeed a SyslogAppender.

Been searching the Web on how to configure it. Eventually I came up with this:

In section “Custom ranger-hdfs-audit” :

xasecure.audit.destination.log4j=true 
xasecure.audit.destination.log4j.logger=xaaudit
xasecure.audit.log4j.is.enabled=true

In section “Advanced hdfs-log4j” add:

log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSLOG.SyslogHost=<SIEM syslog listener IP Address>
log4j.appender.SYSLOG.Facility=Local2
log4j.appender.SYSLOG.FacilityPrinting=true
log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSLOG.layout.ConversionPattern=%m%n
log4j.logger.xaaudit=INFO,SYSLOG

Then, restarting Ranger,

I didn't seem to get any syslog from Ranger.

Sources I've Checked:

http://sonargdocs.jsonar.com/latest/hadoop.html

https://stackoverflow.com/questions/48077643/configure-syslogappender-in-log4j-properties-in-alfresc...

Is there anything else I'm missing?

I've been trying to piece everything together on my own as I didn't find any manuals that describe how to configure log4j with SyslogAppender over Apache Ranger

UPDATE: I seem to be getting errors in the logs:

log4j:ERROR Could not instantiate appender named "Syslog".
log4j:ERROR Could not find value for key log4j.appender.Syslog
log4j:ERROR Could not instantiate appender named "Syslog"

-safemode get | grep 'Safe mode is OFF'' returned 1. log4j:ERROR Could not find value for key log4j.appender.Syslog

log4j:ERROR Could not find value for key log4j.appender.Syslog

[#2]

Hello,

Did you resolve your problem? Does Ranger official support integration with Syslog?

Do you have some manual how to do that?

[#3]

It works perfectly, thanks.

[#4]

@ururu I have a similar use case but the configurations mentioned above are not giving the desired results. Did you add or modify some of the configurations?

E.g., I saw it being mentioned elsewhere that the hadoop.root.logger value needs to be changed as well to include SYSLOG as a value. Did you do this too?

Also, in case the external SIEM server expects a particular format, e.g., the RFC 5424 syslog format or a specific SIEM server format like Universal LEEF, what would be the best way to define this property?