Nigel, There is one option which introduced by https://issues.apache.org/jira/browse/RANGER-1310.
This will enable you to always spool to local disk first before the audit is pushed to the destinations. This guarantees that the audit data is not lost if the memory queue is destroyed by the restart of of the any components. Thanks, Ramesh On 3/6/17, 9:31 AM, "Don Bosco Durai" <[email protected]> wrote: >All your assumptions are correct, except. > >> * unless the queue size is exceeded in which case events are lost >The audit framework will automatically start spooling to file if: >- Queue size is exceeded >- Destination is down for extended period (I think 10 minutes, but need >to verify) > >Bosco > >On 3/6/17, 9:28 AM, "Nigel Jones" <[email protected]> wrote: > > I'm planning to use Solr for audit (easy searching, aggregation) and > trying to understand failure modes.... > > If solr is not ready when the plugin starts up I assume we'll try to > connect (1s?) then wait for a period (30s) then retry > > However this is on an async thread, and meanwhile audit events are > queues in memory locally ... so > > * If solr starts after the plugin, initial events are delayed but >then > will log > * if solr breaks, events will temporarily pause, but then resume once > solr back up > * unless the queue size is exceeded in which case events are lost > > is my understanding correct? > > Thanks :-) > Nigel. > > > > >
