[RANGER-3260] Update default hdfs audit filters to filter out unwanted audits

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.0
• Fix Version/s: 3.0.0, 2.2.0
• Component/s: Ranger
• Assignee: Mateen Mansoori
• Reporter: Abhishek Shukla
• Created: 27/Apr/21 10:18
• Updated: 12/May/21 04:01
• Resolved: 11/May/21 08:59

Description

Can we update the default hdfs audit filters as follows: 

This will filter out hdfs audits related to hdfs, hue, oozie, spark, mapred, hbase service users access audits.

[
  {
    "accessResult":"DENIED",
    "isAudited":true
  },
  {
    "actions":[
      "delete",
      "rename"
    ],
    "isAudited":true
  },
  {
    "users":[
      "hdfs"
    ],
    "actions":[
      "listStatus",
      "getfileinfo",
      "listCachePools",
      "listCacheDirectives",
      "listCorruptFileBlocks",
      "monitorHealth",
      "rollEditLog",
      "open"
    ],
    "isAudited":false
  },
  {
    "users":[
      "oozie"
    ],
    "resources":{
      "path":{
        "values":[
          "/user/oozie/share/lib"
        ],
        "isRecursive":true
      }
    },
    "isAudited":false
  },
  {
    "users":[
      "spark"
    ],
    "resources":{
      "path":{
        "values":[
          "/user/spark/applicationHistory"
        ],
        "isRecursive":true
      }
    },
    "isAudited":false
  },
  {
    "users":[
      "hue"
    ],
    "resources":{
      "path":{
        "values":[
          "/user/hue"
        ],
        "isRecursive":true
      }
    },
    "isAudited":false
  },
  {
    "users":[
      "hbase"
    ],
    "resources":{
      "path":{
        "values":[
          "/hbase"
        ],
        "isRecursive":true
      }
    },
    "isAudited":false
  },
  {
    "users":[
      "mapred"
    ],
    "resources":{
      "path":{
        "values":[
          "/user/history"
        ],
        "isRecursive":true
      }
    },
    "isAudited":false
  },
  {
    "actions":[
      "getfileinfo"
    ],
    "isAudited":false
  }
]

cc dineshkumar-yadav

Issue Links

• is related to: RANGER-3257 Update default kafka audit filters to filter out unwanted audits
• links to: Apache RR