we are usign solr to store audit information for ranger. It seems the audit information is piling on solr. Is there a way to purge audit information after a particular period of time. we dont want to store the audit information forever.
There is not setting in Ranger that specifies how long to keep Audits. However, you can purge the audits from Solr using the Document Expiration functionality.
Having said that, the best practice is to store Ranger audit logs in both, Solr and HDFS. This way you can use the logs in Solr for your short-term indexed queries and the logs in HDFS for your long-term archived/queryable logs.