Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

On-boarding Ranger Audit logs to SIEM

avatar
New Contributor

Hello,

 

We are in the process of setting up our Cloudera and would like to request you to provide the steps to Integrate Audit logs from Ranger to SIEM (splunk) systems. Request you to let us know if there are any other services needed on the cluster to get this Integration(other than Ranger). 

 

Thanks a lot.

 

Regards,

Madhuri

4 REPLIES 4

avatar
Rising Star

Hi Madhuri,

 

Streaming Ranger audits to third-party services (other than HDFS, Solr) is still not officially supported. I found this article though, can you check if that helps:
https://my.cloudera.com/knowledge/How-to-send-Ranger-audit-logs-to-log4j-appenders?id=276802

Also, there's a Github page to enable streaming Ranger audits to Kafka topics:

https://github.com/Raghav-Guru/kafka-ranger-audit

Here's an Apache document on steps to enable Audits to a component that has log4j appender:

https://cwiki.apache.org/confluence/display/RANGER/Ranger+0.5+Audit+Configuration#Ranger0.5AuditConf...

avatar
New Contributor

Madhuri, did you get any solution for this .. I am looking for the same audit logs into Splunk.

avatar
Contributor

Hi All,

 

You can check the below article for more details on Configuring Apache ranger to send syslog to a SIEM system:

https://community.cloudera.com/t5/Support-Questions/Configuring-Apache-Ranger-to-send-Syslog-to-a-SI...

 

We officially support two destination location for ranger audits i.e. HDFS & SOLR
Audits to log4j is a community feature and not certified by Cloudera Engineering

 

Other KB reference:
https://my.cloudera.com/knowledge/How-to-send-Ranger-audit-logs-to-log4j-appenders?id=276802

avatar
Community Manager

@ammukana, did any of the replies helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future. 



Regards,

Vidya Sargur,
Community Manager


Was your question answered? Make sure to mark the answer as the accepted solution.
If you find a reply useful, say thanks by clicking on the thumbs up button.
Learn more about the Cloudera Community: