@luis marmolejo You can conifgure Ranger Audit to go to Log4J appender. In this way a copy can be sent to file as you needed. Configure these properties via Ambari for the respective components if you are using Ambari for managing. 1 ) You need to enable auditing to log4j appender by adding the following property to ranger-<component>-audit.xml <property> <name>xasecure.audit.log4j.is.enabled</name> <value>true</value> </property> <property> <name>xasecure.audit.destination.log4j</name> <value>true</value> </property> <property> <name>xasecure.audit.destination.log4j.logger</name> <value>xaaudit</value> </property> 2) Add the appender to the log4j.properties or log4j.xml file for the <component> ranger.logger=INFO,console,RANGERAUDIT log4j.logger.xaaudit=${ranger.logger} log4j.appender.RANGERAUDIT=org.apache.log4j.DailyRollingFileAppender log4j.appender.RANGERAUDIT.File=/tmp/ranger_hdfs_audit.log log4j.appender.RANGERAUDIT.layout=org.apache.log4j.PatternLayout log4j.appender.RANGERAUDIT.layout.ConversionPattern=%d{ISO8601} %p %c{2}: %L %m%n log4j.appender.RANGERAUDIT.DatePattern=.yyyy-MM-dd restart the respective component. A copy of the Ranger Audit will be sent to /tmp/ranger_hdfs_audit.log ( in this case )
... View more
