Skip to main content
Amn_468
Amn_468
Silver ⭐️⭐️⭐️
May 31, 2021
Solved

Impala Audit & Lineage Logs

Hello,

I need some assistance / guidance related to Impala Audit & Lineage Logs.

In our cluster I  see Impala Audit Logs (enable_audit_event_log) Un-checked, yet on the node level we see logs getting generated.

1.jpg

[service1@myserver audit]# ls -ltrh
total 215M
-rw-r--r-- 1 impala impala 4.2M May 27 14:45 impala_audit_event_log_1.0-1622078304372
-rw-r--r-- 1 impala impala 3.9M May 27 15:34 impala_audit_event_log_1.0-1622083537006
-rw-r--r-- 1 impala impala 4.3M May 27 16:44 impala_audit_event_log_1.0-1622086468134
-rw-r--r-- 1 impala impala 4.3M May 27 17:18 impala_audit_event_log_1.0-1622090691805
-rw-r--r-- 1 impala impala 4.3M May 27 18:26 impala_audit_event_log_1.0-1622092726630
-rw-r--r-- 1 impala impala 4.2M May 27 20:07 impala_audit_event_log_1.0-1622096799288
-rw-r--r-- 1 impala impala 4.0M May 27 21:17 impala_audit_event_log_1.0-1622102850640
-rw-r--r-- 1 impala impala 3.7M May 28 01:36 impala_audit_event_log_1.0-1622107032783
-rw-r--r-- 1 impala impala 2.7M May 28 14:34 impala_audit_event_log_1.0-1622122581046
-rw-r--r-- 1 impala impala 4.7M May 28 18:17 impala_audit_event_log_1.0-1622169268919
-rw-r--r-- 1 impala impala 4.3M May 28 19:34 impala_audit_event_log_1.0-1622182634220
-rw-r--r-- 1 impala impala 4.3M May 28 20:30 impala_audit_event_log_1.0-1622187283341
-rw-r--r-- 1 impala impala 4.3M May 28 20:58 impala_audit_event_log_1.0-1622190632083
-rw-r--r-- 1 impala impala 4.4M May 28 21:25 impala_audit_event_log_1.0-1622192312991

 

Could anyone please share some light as to why this is happening? I was under the impression that if this is checked only then logs would get captured, kindly clarify

CM / CDH – 6.3.3

 

Thanks 

Amn

salimhussain
salimhussainAnswer
Gold ⭐️
June 23, 2021

Cluster restart also restarts Impala service. Could you please double check if following two properties are unchecked in CM > Impala > Configuration  
Enable Audit Collection
Enable Impala Audit Event Generation

To be able to disable auditing for Impala service, you need to uncheck both of the above options. Once done make sure to restart Impala service. CM would show stale and restart icon as well.  

View in thread

6 replies

salimhussain
Gold ⭐️
salimhussain
Gold ⭐️
June 1, 2021

This is correct, if Enable Impala Audit Event Generation is unchecked, it will disable Impala daemon Audit logging, See documentation [1]. I hope after setting this property, you would have restarted Impala daemon roles. If not, restart now and after restart you should not see new audit files being created but old files would still be there. 

Can you check and confirm if these logs are generated on single Impala daemon hosts or on all Impala Daemon hosts even after it is disabled and Impala daemons restarted?

 

[1]

https://docs.cloudera.com/documentation/enterprise/6/6.3/topics/cn_admcfg_audit_log.html#configure_impala_daemon_log

Translate
VidyaSargur
Community Manager
VidyaSargur
Community Manager
June 14, 2021

Hi, @Amn_468 did you resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future. 

Translate
Regards, Vidya Sargur, Community Manager Was your question answered? Make sure to mark the answer as the accepted solution. If you find a reply useful, say thanks by clicking on the thumbs up button.
Terms & ConditionsAccessibility statement