Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

HDFS audit log

Solved Go to solution

HDFS audit log

New Contributor

Is there a reason why there is a forward slash "/" in the "ip" field in front of the real IP Address in hdfs-audit.log?

2017-01-27 00:00:01,300 INFO FSNamesystem.audit: allowed=true ugi=SOMETHING.COM (auth:KERBEROS) ip=/172.22.7.129 cmd=listStatus src=/apps/hbase/data/archive/data/default/ambarismoketest dst=null perm=null proto=rpc callerContext=CLI

1 ACCEPTED SOLUTION

Accepted Solutions

Re: HDFS audit log

Contributor

Very good question! Let's dig into Hadoop's source to find this out.

The audit log uses java.net.InetAddress's toString() method to obtain a text format of the address:

https://github.com/apache/hadoop/blob/trunk/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache...

InetAddress's returns the information in "hostname/ip" format. If the hostname is not resolvable (reverse lookup is not working) then you get a starting slash:

http://docs.oracle.com/javase/7/docs/api/java/net/InetAddress.html#toString()

1 REPLY 1

Re: HDFS audit log

Contributor

Very good question! Let's dig into Hadoop's source to find this out.

The audit log uses java.net.InetAddress's toString() method to obtain a text format of the address:

https://github.com/apache/hadoop/blob/trunk/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache...

InetAddress's returns the information in "hostname/ip" format. If the hostname is not resolvable (reverse lookup is not working) then you get a starting slash:

http://docs.oracle.com/javase/7/docs/api/java/net/InetAddress.html#toString()

Don't have an account?
Coming from Hortonworks? Activate your account here