How to find who deleted the tables?

[#1]

Hey, someone deleted the tables from HDFS and it has been more than 24 hours, so we couldn't recover due to interval time, now we need to find when and which user deleted the file, I checked the hadoop-hdfs and hive logs but couldn't find anything related to deleted table.

[#2]

@reca Do you have Ranger enabled? You can check in Ranger audits.

[#3]

Hi @reca 

If you are on CDH you can use navigator [1] and if you are on CDP you can use Ranger [2]

[1] https://docs.cloudera.com/documentation/enterprise/6/6.3/topics/cn_iu_audit_usecase.html 

[2] https://docs.cloudera.com/cdp-private-cloud-base/7.1.6/security-ranger-auditing/topics/security-rang...

[#4]

@reca Has the reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future. Thanks