Why we have 2 audit for one service? Since ranger audit stores in HDFS and native HDFS stores in local filesystem. We can keep it as backup? Or different information?
@Anpan K HDFS audit is different than Ranger audit. They are complementary. The benifit of using Ranger to check the audit is that everything is on centralized location, while hdfs audit you have to check on each node local disk.
*** If you found this answer addressed your question, please take a moment to login and click the "accept" link on the answer.
HDFS audit is different from ranger hdfs audit. Ranger HDFS audit works only when "Ranger HDFS" plugin is enabled. In case you want audits when Ranger HDFS plugin is not enabled, then you use hdfs audits. If ranger hdfs plugin is enabled, then you use ranger hdfs audits.
Ranger audits are stored in HDFS and also can be stored in Solr. To put audits to Solr, enable "Audits to Solr" plugin from Ambari.
You can see the logs in Ranger UI if the audits are logged to Solr , it cannot read audits from HDFS.