Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

HDFS audit log

avatar
Explorer

Is there a reason why there is a forward slash "/" in the "ip" field in front of the real IP Address in hdfs-audit.log?

2017-01-27 00:00:01,300 INFO FSNamesystem.audit: allowed=true ugi=SOMETHING.COM (auth:KERBEROS) ip=/172.22.7.129 cmd=listStatus src=/apps/hbase/data/archive/data/default/ambarismoketest dst=null perm=null proto=rpc callerContext=CLI

1 ACCEPTED SOLUTION

avatar
Expert Contributor

Very good question! Let's dig into Hadoop's source to find this out.

The audit log uses java.net.InetAddress's toString() method to obtain a text format of the address:

https://github.com/apache/hadoop/blob/trunk/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache...

InetAddress's returns the information in "hostname/ip" format. If the hostname is not resolvable (reverse lookup is not working) then you get a starting slash:

http://docs.oracle.com/javase/7/docs/api/java/net/InetAddress.html#toString()

View solution in original post

1 REPLY 1

avatar
Expert Contributor

Very good question! Let's dig into Hadoop's source to find this out.

The audit log uses java.net.InetAddress's toString() method to obtain a text format of the address:

https://github.com/apache/hadoop/blob/trunk/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache...

InetAddress's returns the information in "hostname/ip" format. If the hostname is not resolvable (reverse lookup is not working) then you get a starting slash:

http://docs.oracle.com/javase/7/docs/api/java/net/InetAddress.html#toString()