Is it possible to not log about OPEN event in Navigator please?

[#1]

Dear sir / madam,

Our cloudera versiion is 5.7.2 with Navigator and the metadata database is Postgresql. We are facing a problem about the metadata database goes full very quickly. I did query the metadata database and found that the event about OPEN got more than 48,542,073 records per day. (select ip_addr, operation, count(*) as C from hdfs_audit_events_2017_10_02 group by ip_addr, operation order by C;). Therefore is there any way to not log about OPEN event in Navigator please?

(Here the OPEN event is about open file, NOT open connection; there are the other events such as "create", "rename", "delete" and more)

Your faithfully,
Chao-Kang Chen

[#2 · Accepted solution]

Hello kangkang0705,

You can achieve that via setting up rules for "Audit Event Filter" according to Configuring Service Auditing Properties. Please note that the audit events discarded this way will never reach the Cloudera Navigator database, because of that you'll have no way to review them in the future.

Let me know if that helps.

Best regards,
Zsolt

[#3]

Dear zherczeg

Thank you so much for your kind help! I believe your method will work perfectly. I will implement it tomorrow and report to you the result within this week due to that the admin team might want to observe several days. 

Your sincerely,

Chao-Kang Chen