Hadoop Audit logs

to create new topics or reply. | New User Registration

Tagged: 

This topic contains 1 reply, has 2 voices, and was last updated by  Dave 1 year, 10 months ago.

  • Creator
    Topic
  • #33079

    Ardavan Moinzadeh
    Participant

    I know that HDFS has the ability to log all file system access requests and in HDP is set to INFO by default, is there a way to see what users have accessed HDFS ? This is what I am currently seeing in hdfs-audit.log
    2013-08-23 00:06:31,257 INFO FSNamesystem.audit: ugi=hbase ip=/X.X.X cmd=listStatus src=/apps/hbase/data dst=null perm=null

    In this scenario I want to see what user have accessed hbase.

    Thank you

Viewing 1 replies (of 1 total)

You must be to reply to this topic. | Create Account

  • Author
    Replies
  • #33080

    Dave
    Moderator

    Hi Ardavan,

    You could tally up the times with /var/log/secure and see which user issued the su or sudo command to the user hbase.
    I am unaware of any way to trace this in HDFS due to the way the underlying UNIX system works. I.E the request comes from hbase as we can’t see the user before hand (especially due to su or sudo as a new shell is initiated)

    Thanks

    Dave

    Collapse
Viewing 1 replies (of 1 total)
Hortonworks Data Platform
The Hortonworks Data Platform is a 100% open source distribution of Apache Hadoop that is truly enterprise grade having been built, tested and hardened with enterprise rigor.
Get started with Sandbox
Hortonworks Sandbox is a self-contained virtual machine with Apache Hadoop pre-configured alongside a set of hands-on, step-by-step Hadoop tutorials.
Modern Data Architecture
Tackle the challenges of big data. Hadoop integrates with existing EDW, RDBMS and MPP systems to deliver lower cost, higher capacity infrastructure.