Created 09-20-2016 07:34 AM
I'm running HDP 2.5 and are audit logging Hive querys with both Solr and HDFS. My problem is that the HDFS files wont get updated until I restart the HiveServer. But if I do, the files gets written correctly. Right now, I have been waiting for over one hour and nothing are in the files. I do see the audit logs in the Ranger Admin interfaec (with the help of Solr) correctly.
Is there any way to force Hive to write the audit logs to HDFS after a specific amount of time, and/or number of audit records?
Created 09-20-2016 07:39 AM
@Berry,
You can follow the below link to do it in proper manner,
http://hortonworks.com/blog/best-practices-for-hive-authorization-using-apache-ranger-in-hdp-2-2/
Created 09-28-2016 10:08 AM
If anybody else wonders about this behaviour, the default is to write to rollover the audit log every 24 hours. To change the time, you set xasecure.audit.destination.hdfs.file.rollover.sec (in custom ranger-hive-audit) to the number of seconds between the rollover.
You can read more about it on https://cwiki.apache.org/confluence/display/RANGER/Ranger+0.5+Audit+Configuration under the "Audit to HDFS" part.
Created 12-10-2018 11:02 AM
Please can you tell me how to stop ranger from making new log file instead append the logs into single file.