Mysql or solr for ranger

[#1]

Which one to use for ranger audits. Mysql or solr. I have a small lab cluster. Any thoughts

[#2 · Accepted solution]

@ARUN

The MySQL option is fine for small to medium clusters, given enough database horsepower behind it, however it's going to struggle on higher through puts. As your cluster gets larger and busier, you'd need to almost move the MySQL db to a dedicated machine etc.

The url you quoted is from early on in Ranger's history, there is now an Apache Solr backend for the Ranger audit db, which is significantly more scalable.https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.0/bk_Ranger_Install_Guide/content/ch_install_...

These days almost everyone start with the Solr backend as it's more scalable and will lead to fewer issues in the future as the cluster grows. Unless you have a very small environment, go Solr!

.

[#3]

@Jay SenSharma, IS it possible to just use HDFS alone as the back end for audits?

[#4]

@ARUN

Are you looking out for this:

1. https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.0/bk_Ranger_Install_Guide/content/save_audits...

2. https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.2/bk_Ranger_Install_Guide/content/audit_to_so...

It is recommended that Ranger audits be written to both Solr and HDFS. Audits to Solr are primarily used to enable queries from the Ranger Admin UI. HDFS is a long-term destination for audits -- audits stored in HDFS can be exported to any SIEM system, or to another audit store.

.

[#5]

yes @Jay SenSharma, jsut want a confirmation whether i can store the audits only on hdfs alone. i dont want the solr option becasuee of resource constraints and the DB option is not available in the ambari. i am using hdp 2.5

[#6]

@ARUN

Please see the above screenshot showing how to use only "HDFS" option for audits.

[#7]

Please note DB based auditing is NOT supported from Ranger 0.6 (HDP 2.5)