Created 05-25-2017 05:35 AM
we are usign solr to store audit information for ranger. It seems the audit information is piling on solr. Is there a way to purge audit information after a particular period of time. we dont want to store the audit information forever.
Created 05-25-2017 02:03 PM
There is not setting in Ranger that specifies how long to keep Audits. However, you can purge the audits from Solr using the Document Expiration functionality.
Having said that, the best practice is to store Ranger audit logs in both, Solr and HDFS. This way you can use the logs in Solr for your short-term indexed queries and the logs in HDFS for your long-term archived/queryable logs.
Created 06-06-2017 04:06 PM
See this link for modifying solr config for ranger audit.