[RANGER-858] Audit is generated when "Audit logging=no"

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Bug
• Affects Version/s: 0.5.0
• Component/s: audit
• Environment: HDP 2.3.4
• Assignee: Unassigned
• Reporter: Jordan Naftolin
• Created: 22/Feb/16 17:28
• Updated: 15/Mar/16 18:21
• Resolved: 15/Mar/16 18:21

Description

We have a Ranger HDFS policy with some overlapping rules like these:

(Id=1) (Resouce=/tmp) (recursive) (Audit logging=yes)
(Id=2) (Resource=/tmp/hive/ambari-qa/*) (Audit logging=no)

Ranger plugin is generating entries from policy id=2 in audit log. They should not be generated because audit logging is set to no for policy id=2. If I turn audit logging to no in policy id=1 the problem doesn't ocurr. I also tried to change the order of the two policies but it doesn't change the behavior.

It seems that the audit logging variable is set to yes from the first generic rule and it's not reset to the value of the more specific rule.