Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 3.0.0-alpha1
    • Component/s: None
    • Labels:
      None
    • Hadoop Flags:
      Incompatible change, Reviewed
    • Release Note:
      Hide
      <!-- markdown -->

      Audit logs will now only be generated in the following two cases:
      * When an operation results in an `AccessControlException`
      * When an operation is successful

      Notably, this means audit log events will not be generated for exceptions besides AccessControlException.
      Show
      <!-- markdown --> Audit logs will now only be generated in the following two cases: * When an operation results in an `AccessControlException` * When an operation is successful Notably, this means audit log events will not be generated for exceptions besides AccessControlException.

      Description

      So, the big question here is what should go in the audit log? All failures, or just "permission denied" failures? Or, to put it a different way, if someone attempts to do something and it fails because a file doesn't exist, is that worth an audit log entry?

      We are currently inconsistent on this point. For example, concat, getContentSummary, addCacheDirective, and setErasureEncodingPolicy create an audit log entry for all failures, but setOwner, delete, and setAclEntries attempt to only create an entry for AccessControlException-based failures. There are a few operations, like allowSnapshot, disallowSnapshot, and startRollingUpgrade that never create audit log failure entries at all. They simply log nothing for any failure, and log success for a successful operation.

      So to summarize, different HDFS operations currently fall into 3 categories:
      1. audit-log all failures
      2. audit-log only AccessControlException failures
      3. never audit-log failures

      Which category is right? And how can we fix the inconsistency

        Attachments

        1. HDFS-9395-branch-2.7.002.patch
          41 kB
          Kuhu Shukla
        2. HDFS-9395-branch-2.7.001.patch
          41 kB
          Kuhu Shukla
        3. HDFS-9395.007.patch
          42 kB
          Kuhu Shukla
        4. HDFS-9395.006.patch
          41 kB
          Kuhu Shukla
        5. HDFS-9395.005.patch
          36 kB
          Kuhu Shukla
        6. HDFS-9395.004.patch
          30 kB
          Kuhu Shukla
        7. HDFS-9395.003.patch
          30 kB
          Kuhu Shukla
        8. HDFS-9395.002.patch
          19 kB
          Kuhu Shukla
        9. HDFS-9395.001.patch
          20 kB
          Kuhu Shukla

          Issue Links

            Activity

              People

              • Assignee:
                kshukla Kuhu Shukla
                Reporter:
                kihwal Kihwal Lee
              • Votes:
                0 Vote for this issue
                Watchers:
                15 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: