Auditing Authorization Events

The HAWQ Ranger Plug-in Service supports storing auditing records in any of the Ranger auditing framework audit destinations, referred to as *audit sink*s. The /usr/local/hawq/ranger/etc/ranger-hawq-audit.xml file specifies the audit configuration. It contains sample definitions for the HDFS, Solr, and Log4j audit sinks.

As a best practice, configure one or more audit sinks in ranger-hawq-audit.xml before you register the HAWQ Ranger Plug-in Service. By default only the Log4j sink is enabled. Production deployments should use both a Solr and an HDFS audit sink, with the Solr destination configured to automatically purge audit records after some period of time. This configuration enables you to search the most recent audit records, while keeping a full history of auditing records in HDFS.

If you modify ranger-hawq-audit.xml after you have registered the HAWQ Ranger Plug-in, you must restart the plug-in for the changes to take effect. See Custom Configuration for instructions.

Full documentation for the Ranger auditing configuration properties and the Ranger auditing framework is available at Ranger 0.5 Audit Configuration.

Configuring Solr Auditing

To configure a Solr audit sink, you define a different set of properties in ranger-hawq-audit.xml depending on whether you use Zookeeper or a direct URL connect to your Solr destination. For a production environment, use Zookeeper instead of a direct URL.

If you use Zookeeper to connect to Solr, configure these auditing properties in ranger-hawq-audit.xml:

Table 1. Properties for Zookeeper Configuration

For example:

<!-- ********************************* -->
<!-- SOLR audit provider configuration -->
<!-- ********************************* -->
<property>
    <name>xasecure.audit.destination.solr</name>
    <value>true</value>
</property>

<property>
    <name>xasecure.audit.destination.solr.zookeepers</name>
    <value>zkhost1:2181,zkhost2:2181/infra-solr</value>
</property>

<property>
    <name>xasecure.audit.destination.solr.collection</name>
    <value>ranger_audits</value>
</property>

<property>
    <name>xasecure.audit.destination.solr.urls</name>
    <value>NONE</value>
</property>

<property>
    <name>xasecure.audit.destination.solr.batch.filespool.enabled</name>
    <value>true</value>
</property>

<property>
    <name>xasecure.audit.destination.solr.batch.filespool.dir</name>
    <value>/usr/local/hawq_<version>/ranger/plugin-service/logs/spool/audit/solr</value>
</property>

Configuring HDFS Auditing

To configure an HDFS audit sink, define these auditing properties in ranger-hawq-audit.xml:

Table 2. Properties for HDFS Configuration

For example:

<!-- ********************************* -->
<!-- HDFS audit provider configuration -->
<!-- ********************************* -->
<property>
    <name>xasecure.audit.destination.hdfs</name>
    <value>true</value>
</property>

<property>
    <name>xasecure.audit.destination.hdfs.dir</name>
    <value>hdfs://localhost:8020/ranger/audit</value>
</property>

<property>
    <name>xasecure.audit.destination.hdfs.batch.filespool.enabled</name>
    <value>true</value>
</property>

<property>
    <name>xasecure.audit.destination.hdfs.batch.filespool.dir</name>
    <value>/usr/local/hawq_<version>/ranger/plugin-service/logs/spool/audit/hdfs</value>
</property>

Configuring Log4j Auditing

To configure a Log4j audit sink, define these auditing properties in ranger-hawq-audit.xml:

Table 3. Properties for Log4j Configuration

For example:

<!-- ********************************** -->
<!-- Log4j audit provider configuration -->
<!-- ********************************** -->
<property>
    <name>xasecure.audit.destination.log4j</name>
    <value>true</value>
</property>

<property>
    <name>xasecure.audit.destination.log4j.logger</name>
    <value>ranger_audit_logger</value>
</property>