I am wondering how the final HDFS path for storing Ranger audits is being generated, because it doesn't match the configured property via Ambari.
Configuration looks like:
checked via /etc/hadoop/conf/ranger-hdfs-audit.xml :
But the created folder in HDFS is:
I expected having the audit-log-files under "hdfs://.../ranger/audit/20161130" directly.
Why is there the subfolder "hdfs" and an additional subfolder with the yyyyMMdd again ?!?!
Maybe a known bug/issue in the version in use: HDP 18.104.22.168, Ambari 22.214.171.124 ?!?!
Thanks for any feedback...
@Gerd Koenig xasecure.audit.destination.hdfs.dir should be the base path for all audit logs for all plugins. The plugins themselves add their own name - 'hdfs' in this case, Hiveserver2 adds 'hiveserver2', Hbase adds 'hbase', etc - and a daily datestamp automatically. This behaviour is fixed and I don't think there's any way to change it. You should just set it to 'hdfs://<Nameservice ID>/ranger/audit'
Some part of hdfs audit destination is controllable since RANGER-397.
For example below change the destination file to hdfs://sandbox.hortonworks.com:8020/ranger/audit/hdfs/hdfs_ranger_audit_sandbox.hortonworks.com_20170801.log:
<name>xasecure.audit.destination.hdfs.filename.format</name> <value>%app-type%_ranger_audit_%hostname%_%time:yyyyMMdd%.log</value> <name>xasecure.audit.destination.hdfs.subdir</name> <value>%app-type%</value>