Enabling Audit Logging in Non-Ambari Clusters

It is recommended that Ranger audits be written to both Solr and HDFS. Audits to Solr are primarily used to enable queries from the Ranger Admin UI. HDFS is a long-term destination for audits; audits stored in HDFS can be exported to any SIEM system, or to another audit store.

To enable auditing for HDFS, perform the steps listed below.

Set the XAAUDIT.HDFS.ENABLE value to "true" for the component plug-in in the install.properties file, which can be found here:
```
/usr/hdp/<version>/ranger-<component>=plugin
```
Configure the NameNode host in the XAAUDIT.HDFS.HDFS_DIR field.
Create a policy in the HDFS service from the Ranger Admin for individual component users (hive/hbase/knox/storm/yarn/kafka/kms) to provide READ and WRITE permissions for the audit folder (i.e., for enabling Hive component to log Audits to HDFS, you need to create a policy for the hive user with Read and WRITE permissions for the audit directory).
Set the Audit to HDFS caches logs in the local directory, which can be specified in XAAUDIT.HDFS.LOCAL_BUFFER_DIRECTORY (this can be like /var/log/<component>/**), which is the path where the audit is stored for a short time. This is similar for archive logs that need to be updated.

To enable auditing reporting from the Solr database, perform the steps listed below.

Modify the following properties in the Ranger service install.properties to enable auditing to the Solr database in Ranger:
- audit_store=solr
- For HDP Search's Solr Instance: http:<solr_host>:8983/solr/ranger_audits
  For Ambari Infra's Solr Instance: http:<solr_host>:8886/solr/ranger_audits
- audit_solr_user=ranger_solr
- audit_solr_password-NONE
Restart Ranger.

To enable auditing to the Solr database for a plug-in (e.g., HBase), perform the steps listed below.

Set the following properties in install.properties of the plug-in to begin audit logging to the Solr database:
- XAAUDIT.SOLR.IS.ENABLED=true
- XAAUDIT.SOLR.ENABLE=true
- For HDP Search's Solr Instance: XAAUDIT.SOLR.URL= http://solr_host:8983/solr/ranger_audits
  For Ambari Infra's Solr Instance: XAAUDIT.SOLR.URL= http://solr_host:8886/solr/ranger_audits
- XAAUDIT.SOLR.USER-ranger_solr
- XAAUDIT.SOLR.PASSWORD=NONE
- XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/hadoop/hdfs/audit/solr/spool
Enable the Ranger HBase plug-in.
Restart the HBase component.

​Enabling Audit Logging in Non-Ambari Clusters

Enabling Audit Logging in Non-Ambari Clusters