[RANGER-1310] Ranger Audit framework enhancement to provide an option to allow audit records to be spooled to local disk first before sending it to destinations

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.7.0
• Assignee: Ramesh Mani
• Reporter: Ramesh Mani
• Created: 17/Jan/17 01:42
• Updated: 19/Mar/17 20:57
• Resolved: 10/Feb/17 23:04

Description

Ranger Audit framework enhancement to provide an option to allow audit records to be spooled to local disk first before sending it to destinations.
xasecure.audit.provider.filecache.is.enabled = true ==> This will enable this functionality of AuditFileCacheProivder to log the audits locally in a file.
xasecure.audit.provider.filecache.filespool.file.rollover.sec = {rollover time - default is 1 day} ==> this provides time to send the audit records from local to destination and flush the pipe.
xasecure.audit.provider.filecache.filespool.dir=/var/log/hadoop/hdfs/audit/spool ==> provides the directory where the Audit FileSpool cache is present.
This helps in avoiding missing / partial audit records in the hdfs destination which may happen randomly due to restart of respective plugin components.

Issue Links

• links to: Review Link