Solr UI not accessing for ranger audit

[#1]

I am trying to access solr UI for ranger audit logs on HDP sandbox. it seems not be be up; however, the audits are shown in real time on ranger UI. How do I get access to solr UI for ranger audit logs. The link in sandbox is http://localhost:6083/solr/ranger_audits but it is not accessible.

[#2]

Is Ranger's audit source solr or db ? Check your config in Ambari

[#3]

You can also check that port 6083 is configured in the port forwarding setting to access http://localhost:6083/solr/ranger_audits.

For Audit not being in Ranger UI you need to check what is configured for ranger.audit.source.type in ranger config. It should be solr.

[#4 · Accepted solution]

I believe in HDP sandbox Ranger audits are going to Mysql (not Solr).

To change audits to go to Solr you would need to;

1. Start Solr and create the ranger_audits collection. The steps for this would differ whether you want Solr to run in standalone or cloud mode

Standalone mode:

https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.4.0/bk_Ranger_Install_Guide/content/solr_ranger...

Cloud mode:

https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.4.0/bk_Ranger_Install_Guide/content/solr_ranger...

2. change the ranger.audit.source.type to solr (from db) under Ambari > Ranger > Configs

3. Set appropriate property to point Ranger to Solr

e.g. in Solr standalone mode, set ranger.audit.solr.urls = http://(your solr host fqdn):6083/solr/ranger_audits

in Cloud mode, instead of providing url you would set ranger.audit.solr.zookeepers = Zk list e.g. ip-172-30-0-180.us-west-2.compute.internal:2181,ip-172-30-0-182.us-west-2.compute.internal:2181,ip-172-30-0-181.us-west-2.compute.internal:2181/ranger_audits

4. Restart Ranger service via Ambari