Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Ranger HDFS Audit from Hive only gets written when Hive restarts

Ranger HDFS Audit from Hive only gets written when Hive restarts

Contributor

I'm running HDP 2.5 and are audit logging Hive querys with both Solr and HDFS. My problem is that the HDFS files wont get updated until I restart the HiveServer. But if I do, the files gets written correctly. Right now, I have been waiting for over one hour and nothing are in the files. I do see the audit logs in the Ranger Admin interfaec (with the help of Solr) correctly.

Is there any way to force Hive to write the audit logs to HDFS after a specific amount of time, and/or number of audit records?

3 REPLIES 3

Re: Ranger HDFS Audit from Hive only gets written when Hive restarts

Contributor

@Berry,

You can follow the below link to do it in proper manner,

http://hortonworks.com/blog/best-practices-for-hive-authorization-using-apache-ranger-in-hdp-2-2/

Re: Ranger HDFS Audit from Hive only gets written when Hive restarts

Contributor

If anybody else wonders about this behaviour, the default is to write to rollover the audit log every 24 hours. To change the time, you set xasecure.audit.destination.hdfs.file.rollover.sec (in custom ranger-hive-audit) to the number of seconds between the rollover.

You can read more about it on https://cwiki.apache.org/confluence/display/RANGER/Ranger+0.5+Audit+Configuration under the "Audit to HDFS" part.

Highlighted

Re: Ranger HDFS Audit from Hive only gets written when Hive restarts

Please can you tell me how to stop ranger from making new log file instead append the logs into single file.