@Saurabh B You can have multiple Activity Analyzers. So , install and start a another Activity Analyzer on the new node. You will see Activity Analyzer in the add components in Ambari. You can stop and remove the earlier Analyzer once the new Analyzer setup is completed. ... View more

Very good question! Let's dig into Hadoop's source to find this out. The audit log uses java.net.InetAddress's toString() method to obtain a text format of the address: https://github.com/apache/hadoop/blob/trunk/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java#L7049 InetAddress's returns the information in "hostname/ip" format. If the hostname is not resolvable (reverse lookup is not working) then you get a starting slash: http://docs.oracle.com/javase/7/docs/api/java/net/InetAddress.html#toString() ... View more