hdfs audit and ranger hdfs audit

[#1]

Hello,

Why we have 2 audit for one service? Since ranger audit stores in HDFS and native HDFS stores in local filesystem. We can keep it as backup? Or different information?

[#2]

@Anpan K HDFS audit is different than Ranger audit. They are complementary. The benifit of using Ranger to check the audit is that everything is on centralized location, while hdfs audit you have to check on each node local disk.

HTH

*** If you found this answer addressed your question, please take a moment to login and click the "accept" link on the answer.

[#3]

@Anpan K Follow the following steps to disable hdfs audit:

https://community.hortonworks.com/questions/101082/disable-log4j-logging-for-hdfs-audit-log.html

Please remember to mark the answer.

[#4]

@Anpan K,

HDFS audit is different from ranger hdfs audit. Ranger HDFS audit works only when "Ranger HDFS" plugin is enabled. In case you want audits when Ranger HDFS plugin is not enabled, then you use hdfs audits. If ranger hdfs plugin is enabled, then you use ranger hdfs audits.

Ranger audits are stored in HDFS and also can be stored in Solr. To put audits to Solr, enable "Audits to Solr" plugin from Ambari.

You can see the logs in Ranger UI if the audits are logged to Solr , it cannot read audits from HDFS.

.

-Aditya

[#5]

Thank you, there is no option to Accept.

[#6]

Thank you and last question. I already have Ranger audit and I need to disable HDFS audtit. How can I disable HDFS audit?