I'm running HDP 2.5 and are audit logging Hive querys with both Solr and HDFS. My problem is that the HDFS files wont get updated until I restart the HiveServer. But if I do, the files gets written correctly. Right now, I have been waiting for over one hour and nothing are in the files. I do see the audit logs in the Ranger Admin interfaec (with the help of Solr) correctly.
Is there any way to force Hive to write the audit logs to HDFS after a specific amount of time, and/or number of audit records?
If anybody else wonders about this behaviour, the default is to write to rollover the audit log every 24 hours. To change the time, you set xasecure.audit.destination.hdfs.file.rollover.sec (in custom ranger-hive-audit) to the number of seconds between the rollover.
You can read more about it on https://cwiki.apache.org/confluence/display/RANGER/Ranger+0.5+Audit+Configuration under the "Audit to HDFS" part.
Please can you tell me how to stop ranger from making new log file instead append the logs into single file.