I've been trying to configure Ranger to send its audit logs via Syslog to our SIEM system. I'd rather avoid storing to Solr and HDFS, which then forces me to query on regular basis in a rather complex production environment. And since Syslog is most common way to transfer audit events to a SIEM system, I've been digging into Log4j Appenders and found that there is a indeed a SyslogAppender.
Been searching the Web on how to configure it. Eventually I came up with this:
In section “Custom ranger-hdfs-audit” :
xasecure.audit.destination.log4j=true xasecure.audit.destination.log4j.logger=xaaudit xasecure.audit.log4j.is.enabled=true
In section “Advanced hdfs-log4j” add:
log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender log4j.appender.SYSLOG.SyslogHost=<SIEM syslog listener IP Address> log4j.appender.SYSLOG.Facility=Local2 log4j.appender.SYSLOG.FacilityPrinting=true log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout log4j.appender.SYSLOG.layout.ConversionPattern=%m%n log4j.logger.xaaudit=INFO,SYSLOG
Then, restarting Ranger,
I didn't seem to get any syslog from Ranger.
Sources I've Checked:
Is there anything else I'm missing?
I've been trying to piece everything together on my own as I didn't find any manuals that describe how to configure log4j with SyslogAppender over Apache Ranger
UPDATE: I seem to be getting errors in the logs:
log4j:ERROR Could not instantiate appender named "Syslog". log4j:ERROR Could not find value for key log4j.appender.Syslog log4j:ERROR Could not instantiate appender named "Syslog" -safemode get | grep 'Safe mode is OFF'' returned 1. log4j:ERROR Could not find value for key log4j.appender.Syslog log4j:ERROR Could not find value for key log4j.appender.Syslog
Did you resolve your problem? Does Ranger official support integration with Syslog?
Do you have some manual how to do that?