> is my understanding correct? Yes.
For completeness, I would like to point out that during outage of an audit sink (in your example solr) there’s also a provision to spool to local disk which should reduce the likelihood of lost events. For more details refer: https://cwiki.apache.org/confluence/display/RANGER/Ranger+0.5+Audit+Configuration#Ranger0.5AuditConfiguration-AuditQueues https://cwiki.apache.org/confluence/display/RANGER/Ranger+0.5+Audit+Configuration#Ranger0.5AuditConfiguration-ConfigurationrelatedtoFilespooling HTH On 3/6/17, 9:28 AM, "Nigel Jones" <[email protected]> wrote: I'm planning to use Solr for audit (easy searching, aggregation) and trying to understand failure modes.... If solr is not ready when the plugin starts up I assume we'll try to connect (1s?) then wait for a period (30s) then retry However this is on an async thread, and meanwhile audit events are queues in memory locally ... so * If solr starts after the plugin, initial events are delayed but then will log * if solr breaks, events will temporarily pause, but then resume once solr back up * unless the queue size is exceeded in which case events are lost is my understanding correct? Thanks :-) Nigel.
