Hi, I've been trying to configure Ranger to send its audit logs via Syslog to our SIEM system. I'd rather avoid storing to Solr and HDFS, which then forces me to query on regular basis in a rather complex production environment. And since Syslog is most common way to transfer audit events to a SIEM system, I've been digging into Log4j Appenders and found that there is a indeed a SyslogAppender. Been searching the Web on how to configure it. Eventually I came up with this: In section “Custom ranger-hdfs-audit” : xasecure.audit.destination.log4j=true xasecure.audit.destination.log4j.logger=xaaudit xasecure.audit.log4j.is.enabled=true In section “Advanced hdfs-log4j” add: log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender log4j.appender.SYSLOG.SyslogHost=<SIEM syslog listener IP Address> log4j.appender.SYSLOG.Facility=Local2 log4j.appender.SYSLOG.FacilityPrinting=true log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout log4j.appender.SYSLOG.layout.ConversionPattern=%m%n log4j.logger.xaaudit=INFO,SYSLOG Then, restarting Ranger, I didn't seem to get any syslog from Ranger. Sources I've Checked: http://sonargdocs.jsonar.com/latest/hadoop.html https://stackoverflow.com/questions/48077643/configure-syslogappender-in-log4j-properties-in-alfresco Is there anything else I'm missing? I've been trying to piece everything together on my own as I didn't find any manuals that describe how to configure log4j with SyslogAppender over Apache Ranger UPDATE: I seem to be getting errors in the logs: log4j:ERROR Could not instantiate appender named "Syslog". log4j:ERROR Could not find value for key log4j.appender.Syslog log4j:ERROR Could not instantiate appender named "Syslog" -safemode get | grep 'Safe mode is OFF'' returned 1. log4j:ERROR Could not find value for key log4j.appender.Syslog log4j:ERROR Could not find value for key log4j.appender.Syslog ... View more