Support Questions

Find answers, ask questions, and share your expertise
Celebrating as our community reaches 100,000 members! Thank you!

Configuring Apache Ranger to send Syslog to a SIEM system via log4j Syslog appender

New Contributor


I've been trying to configure Ranger to send its audit logs via Syslog to our SIEM system. I'd rather avoid storing to Solr and HDFS, which then forces me to query on regular basis in a rather complex production environment. And since Syslog is most common way to transfer audit events to a SIEM system, I've been digging into Log4j Appenders and found that there is a indeed a SyslogAppender.

Been searching the Web on how to configure it. Eventually I came up with this:

In section “Custom ranger-hdfs-audit” :


In section “Advanced hdfs-log4j” add:
log4j.appender.SYSLOG.SyslogHost=<SIEM syslog listener IP Address>

Then, restarting Ranger,

I didn't seem to get any syslog from Ranger.

Sources I've Checked:

Is there anything else I'm missing?

I've been trying to piece everything together on my own as I didn't find any manuals that describe how to configure log4j with SyslogAppender over Apache Ranger

UPDATE: I seem to be getting errors in the logs:

log4j:ERROR Could not instantiate appender named "Syslog".
log4j:ERROR Could not find value for key log4j.appender.Syslog
log4j:ERROR Could not instantiate appender named "Syslog"

-safemode get | grep 'Safe mode is OFF'' returned 1. log4j:ERROR Could not find value for key log4j.appender.Syslog

log4j:ERROR Could not find value for key log4j.appender.Syslog

Rising Star


Did you resolve your problem? Does Ranger official support integration with Syslog?

Do you have some manual how to do that?

Rising Star

It works perfectly, thanks.


@ururu I have a similar use case but the configurations mentioned above are not giving the desired results. Did you add or modify some of the configurations?


E.g., I saw it being mentioned elsewhere that the hadoop.root.logger value needs to be changed as well to include SYSLOG as a value. Did you do this too?

Also, in case the external SIEM server expects a particular format, e.g., the RFC 5424 syslog format or a specific SIEM server format like Universal LEEF, what would be the best way to define this property?