What are the Audit Events tracked in Cloudera?

[#1]

Hi all,

I would like know what sorts of events are being tracked by the Cloudera Navigator Audit Events.

Are all these below mentioned being tracked?

Cluster Activity

Add Cluster

Delete Cluster

Start Cluster

Stop Cluster

Restart Cluster

Refresh Cluster

Node Activity

Add Node

Delete Node

Service Activity

Activate Service

Create Service

Delete Service

Deploy Service

Download Service

Install Service

Start Service

Stop Service

Update Service

Upgrade Service

User Activity

Add User

Delete User

Failure to Login

[#2]

Hi @deshawn_c ,

The audits events you mentioned in the post are captured by Cloudera Manager. 

Cloudera Manager records cluster, host, license, parcel, role, and service lifecycle events (activate, create, delete, deploy, download, install, start, stop, update, upgrade, and so on), user security-related events (add and delete user, login failed and succeeded), and provides an audit UI and API to view, filter, and export such events.

Please see more details from this doc link:

https://docs.cloudera.com/documentation/enterprise/6/latest/topics/cm_dg_audits.html

Thanks and hope it helps,

Li

[#3]

Are we able to see the audit properties set to tracked for service components?

I could find the audit properties for CM.

Under /opt/cloudera/cm directory there's a file audit.properties which states CM audit events that is tracked.

Is there a similar one for Services(e.g. hdfs/hue/hbase)? I believe there should be one somewhere... 

[#4]

Each service will have its own audit setting under CM > {service} > Configuration > Search for "audit". You can see the list of events that are filtered and others will be audited, see screenshot below:

Hope above answers your question.

Cheers

Eric

[#5]

@deshawn_c,

I believe that Cloudera Navigator only audits CDH components, like HDFS, Hive, Impala etc, not CM components.

More information about Navigator can be found here:
https://docs.cloudera.com/documentation/enterprise/latest/topics/datamgmt_intro.html

Cheers
Eric