Home Forums HDP on Linux – Installation Hadoop Audit logs

Tagged: 

This topic contains 1 reply, has 2 voices, and was last updated by  Dave 1 year ago.

  • Creator
    Topic
  • #33079

    Ardavan Moinzadeh
    Participant

    I know that HDFS has the ability to log all file system access requests and in HDP is set to INFO by default, is there a way to see what users have accessed HDFS ? This is what I am currently seeing in hdfs-audit.log
    2013-08-23 00:06:31,257 INFO FSNamesystem.audit: ugi=hbase ip=/X.X.X cmd=listStatus src=/apps/hbase/data dst=null perm=null

    In this scenario I want to see what user have accessed hbase.

    Thank you

Viewing 1 replies (of 1 total)

You must be logged in to reply to this topic.

  • Author
    Replies
  • #33080

    Dave
    Moderator

    Hi Ardavan,

    You could tally up the times with /var/log/secure and see which user issued the su or sudo command to the user hbase.
    I am unaware of any way to trace this in HDFS due to the way the underlying UNIX system works. I.E the request comes from hbase as we can’t see the user before hand (especially due to su or sudo as a new shell is initiated)

    Thanks

    Dave

    Collapse
Viewing 1 replies (of 1 total)