Acceldata
 ODP
Search documentation… ⌘K

Last updated: Sep 24, 2026 11:23 UTC

Enabling Ranger HDFS Audits

To enable HDFS auditing for the supported components in the ODP stack, the following properties must be validated in Ranger.

  • Ensure Ranger is enabled for all components. The Ranger service must be created in the Ranger UI, the service test connection and policies are working.
  • In the Ambari UI, navigate to Ranger > [INLINE_CODE]Configs[/INLINE_CODE]> [INLINE_CODE]RANGER AUDIT[/INLINE_CODE], and enable [INLINE_CODE]Audit to HDFS[/INLINE_CODE].
  • Ensure that the destination HDFS directory is set to hdfs://<nameservice>. You can find the [INLINE_CODE]<nameservice>[/INLINE_CODE] value in Ambari UI > HDFS > Configs > Advanced core-site > [INLINE_CODE]fs.defaultFS[/INLINE_CODE]. Updating the destination HDFS directory should automatically update the HDFS audit path across all Ranger-enabled services, as shown.

Refer to the following documentation pages to enable HDFS auditing for the components.

HDFS

  • In the Ambari UI, navigate to HDFS > [INLINE_CODE]Configs[/INLINE_CODE] > [INLINE_CODE]Advanced ranger-hdfs-audit,[/INLINE_CODE] and enable [INLINE_CODE]Audit to HDFS[/INLINE_CODE].
  • In Advanced ranger-hdfs-audit, verify the following properties.
xasecure.audit.destination.hdfs.batch.filespool.dir=/var/log/hadoop/hdfs/audit/hdfs/spool
xasecure.audit.destination.hdfs.dir=hdfs://<nameservice>/ranger/audit

YARN

  • In the Ambari UI, navigate to YARN > [INLINE_CODE]Configs[/INLINE_CODE] > [INLINE_CODE]Advanced ranger-yarn-audit[/INLINE_CODE], and enable [INLINE_CODE]Audit to HDFS[/INLINE_CODE].
  • In Advanced ranger-yarn-audit, verify the following properties.
xasecure.audit.destination.hdfs.batch.filespool.dir=/var/log/hadoop/yarn/audit/hdfs/spool
xasecure.audit.destination.hdfs.dir=hdfs://<nameservice>/ranger/audit

2025-05-08 17:24:33,646 ERROR utils.RangerJSONAuditWriter (RangerJSONAuditWriter.java:logJSON(117)) - Exception encountered while writing audits to HDFS!
org.apache.hadoop.security.AccessControlException: Permission denied: user=yarn, access=WRITE, inode="/":hdfs:hdfs:drwxr-xr-x
at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.check(FSPermissionChecker.java:506)
at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkPermission(FSPermissionChecker.java:346)
at org.apache.ranger.authorization.hadoop.RangerHdfsAuthorizer$RangerAccessControlEnforcer.checkDefaultEnforcer(RangerHdfsAuthorizer.java:809)
at org.apache.ranger.authorization.hadoop.RangerHdfsAuthorizer$RangerAccessControlEnforcer.checkRangerPermission(RangerHdfsAuthorizer.java:476)
at org.apache.ranger.authorization.hadoop.RangerHdfsAuthorizer$RangerAccessControlEnforcer.checkPermissionWithContext(RangerHdfsAuthorizer.java:261)
at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkPermission(FSPermissionChecker.java:240)
at org.apache.hadoop.hdfs.server.namenode.FSDirectory.checkPermission(FSDirectory.java:1943)
at org.apache.hadoop.hdfs.server.namenode.FSDirectory.checkPermission(FSDirectory.java:1927)
at org.apache.hadoop.hdfs.server.namenode.FSDirectory.checkAncestorAccess(FSDirectory.java:1886)
at org.apache.hadoop.hdfs.server.namenode.FSDirMkdirOp.mkdirs(FSDirMkdirOp.java:60)
at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.mkdirs(FSNamesystem.java:3446)
at org.apache.hadoop.hdfs.server.namenode.NameNodeRpcServer.mkdirs(NameNodeRpcServer.java:1167)
at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolServerSideTranslatorPB.mkdirs(ClientNamenodeProtocolServerSideTranslatorPB.java:742)
at org.apache.hadoop.hdfs.protocol.proto.ClientNamenodeProtocolProtos$ClientNamenodeProtocol$2.callBlockingMethod(ClientNamenodeProtocolProtos.java)
at org.apache.hadoop.ipc.ProtobufRpcEngine2$Server$ProtoBufRpcInvoker.call(ProtobufRpcEngine2.java:621)
at org.apache.hadoop.ipc.ProtobufRpcEngine2$Server$ProtoBufRpcInvoker.call(ProtobufRpcEngine2.java:589)
at org.apache.hadoop.ipc.ProtobufRpcEngine2$Server$ProtoBufRpcInvoker.call(ProtobufRpcEngine2.java:573)
at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:1227)
at org.apache.hadoop.ipc.Server$RpcCall.run(Server.java:1094)
at org.apache.hadoop.ipc.Server$RpcCall.run(Server.java:1017)
at java.base/java.security.AccessController.doPrivileged(Native Method)
at java.base/javax.security.auth.Subject.doAs(Subject.java:423)
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1899)
at org.apache.hadoop.ipc.Server$Handler.run(Server.java:3048)

Hive

  • In the Ambari UI, navigate to Hive> [INLINE_CODE]Configs[/INLINE_CODE] > [INLINE_CODE]Advanced ranger-hive-audit[/INLINE_CODE], and enable [INLINE_CODE]Audit to HDFS[/INLINE_CODE].
  • In Advanced ranger-hive-audit, verify the following properties.
xasecure.audit.destination.hdfs.batch.filespool.dir=/var/log/hive/audit/hdfs/spool
xasecure.audit.destination.hdfs.dir=hdfs://<nameservice>/ranger/audit

Impala

Impala — Audit to HDFS is enabled with Hive by default; no additional settings are required.

HBase

  • In the Ambari UI, navigate to HBase > [INLINE_CODE]Configs[/INLINE_CODE] > [INLINE_CODE]Advanced ranger-hbase-audit[/INLINE_CODE], and enable [INLINE_CODE]Audit to HDFS[/INLINE_CODE].
  • In Advanced ranger-hbase-audit, verify the following properties.
xasecure.audit.destination.hdfs.batch.filespool.dir=/var/log/hbase/audit/hdfs/spool
xasecure.audit.destination.hdfs.dir=hdfs://<nameservice>/ranger/audit

Kafka

  • In the Ambari UI, navigate to Kafka > [INLINE_CODE]Configs[/INLINE_CODE]> [INLINE_CODE]Advanced ranger-kafka-audit[/INLINE_CODE], and enable [INLINE_CODE]Audit to HDFS[/INLINE_CODE].
  • In Advanced ranger-kafka-audit, verify the following properties.
xasecure.audit.destination.hdfs.batch.filespool.dir=/var/log/hbase/audit/hdfs/spool
xasecure.audit.destination.hdfs.dir=hdfs://<nameservice>/ranger/audit

Kafka3

  • In the Ambari UI, navigate to Kafka 3 > [INLINE_CODE]Configs[/INLINE_CODE]> [INLINE_CODE]Advanced ranger-kafka3-audit[/INLINE_CODE], and enable [INLINE_CODE]Audit to HDFS[/INLINE_CODE].
  • In Advanced ranger-kafka3-audit, verify the following properties.
xasecure.audit.destination.hdfs.batch.filespool.dir=/var/log/kafka3/audit/hdfs/spool
xasecure.audit.destination.hdfs.dir=hdfs://<nameservice>/ranger/audit

Ozone

  • In the Ambari UI, navigate to Ozone > [INLINE_CODE]Configs[/INLINE_CODE] > [INLINE_CODE]Advanced ranger-ozone-audit[/INLINE_CODE], and enable [INLINE_CODE]Audit to HDFS[/INLINE_CODE].
  • In Advanced ranger-ozone-audit, verify the following properties.
xasecure.audit.destination.hdfs.batch.filespool.dir=/var/log/hadoop-ozone/audit/hdfs/spool (manual change in ambari)
xasecure.audit.destination.hdfs.dir=hdfs://<nameservice>/ranger/audit (manual change)

RangerKMS

  • In the Ambari UI, navigate to RangerKMS > [INLINE_CODE]Configs[/INLINE_CODE] > [INLINE_CODE]Advanced ranger-rangerkms-audit[/INLINE_CODE], and enable [INLINE_CODE]Audit to HDFS[/INLINE_CODE].
  • In Advanced ranger-kms-audit, update the following properties.
xasecure.audit.destination.hdfs.batch.filespool.dir=/var/log/ranger/kms/audit/hdfs/spool
xasecure.audit.destination.hdfs.dir=hdfs://<nameservice>/ranger/audit

Kudu

Before enabling Ranger HDFS audit for Kudu, ensure the required Ranger policies are in place as outlined in the documentation: Security. On this page, see Ranger.

  • In the Ambari UI, navigate to Kudu > [INLINE_CODE]Configs[/INLINE_CODE] > [INLINE_CODE]Advanced ranger-kudu-audit[/INLINE_CODE], and enable [INLINE_CODE]Audit to HDFS[/INLINE_CODE].
  • In Advanced ranger-kudu-audit, verify the following properties.
xasecure.audit.destination.hdfs=true
xasecure.audit.destination.hdfs.batch.filespool.dir=/var/log/kudu/audit/hdfs/spool
xasecure.audit.destination.hdfs.dir=hdfs://<nameservice>/ranger/audit

Schema Registry

Before enabling Ranger HDFS audit for Schema Registry, ensure the required Ranger policies are in place as outlined in the documentation: Installation. On this page, see Ranger Configuration.

  • In the Ambari UI, navigate to Schema Registry > [INLINE_CODE]Configs[/INLINE_CODE] > [INLINE_CODE]Advanced ranger-schema-registry-audit[/INLINE_CODE], and enable [INLINE_CODE]Audit to HDFS[/INLINE_CODE].
  • In Advanced ranger-schema-registry-audit, update the following properties.
xasecure.audit.destination.hdfs=true
xasecure.audit.destination.hdfs.batch.filespool.dir=/var/log/registry/audit/hdfs/spool
xasecure.audit.destination.hdfs.dir=hdfs://<nameservice>/ranger/audit
xasecure.audit.destination.log4j=false
xasecure.audit.destination.log4j.logger=ranger_audit_logger

Knox

  • In the Ambari UI, navigate to Knox > [INLINE_CODE]Configs[/INLINE_CODE] > [INLINE_CODE]Advanced ranger-knox-audit[/INLINE_CODE], and enable [INLINE_CODE]Audit to HDFS[/INLINE_CODE].
  • In Advanced ranger-knox-audit, update the following properties.
xasecure.audit.destination.hdfs.batch.filespool.dir=/var/log/knox/audit/hdfs/spool
xasecure.audit.destination.hdfs.dir=hdfs://<nameservice>/ranger/audit

NiFi

Before enabling Solr audit for NiFi, ensure the required Ranger policies are in place as outlined in the documentation: NiFi Installation and SSL Enablement. On this page, see Ranger Configuration.

  • Copy hdfs-site.xml and core-site.xml to the NiFi conf directory.
cp /etc/hadoop/conf/hdfs-site.xml /etc/nifi/conf/
cp /etc/hadoop/conf/core-site.xml /etc/nifi/conf/

Verify the following properties under Advanced ranger-nifi-audit.

xasecure.audit.destination.hdfs=true
xasecure.audit.destination.hdfs.batch.filespool.dir=/var/log/nifi/audit/hdfs/spool
xasecure.audit.destination.hdfs.dir=hdfs://<nameservice>/ranger/audit

NiFi Registry

Before enabling Solr audit for NiF-Registry, ensure the required Ranger policies are in place as outlined in the documentation: Installing NiFi Registry. On this page, see see Ranger Configuration.

  • Copy hdfs-site.xml and [INLINE_CODE]core-site.xml[/INLINE_CODE] to the NiFi [INLINE_CODE]conf[/INLINE_CODE] directory.
cp /etc/hadoop/conf/hdfs-site.xml /etc/nifi-registry/conf/
cp /etc/hadoop/conf/core-site.xml /etc/nifi-registry/conf/
  • Verify the following properties under Advanced ranger-nifi-audit.
xasecure.audit.destination.hdfs=true
xasecure.audit.destination.hdfs.batch.filespool.dir=/var/log/nifi/audit/hdfs/spool
xasecure.audit.destination.hdfs.dir=hdfs://<nameservice>/ranger/audit
  • Restart NiFi Registry, and you must be able to view HDFS audits at/ranger/audit/nifi-registry/.