granular ranger audit logs

[#1]

I am trying to configure a policy where only the denied events are logged as there are far too many allowed events.

Is there a way of doing this natively?

[#2]

Hi @Entraux34,

This is not currently possible in Ranger.

In Ranger Admin UI, you could sort the results and that way you could get only the Denied, but auditing only the Denied won't be possible.

I hope this helps.