On 06/03/2017 18:02, Lal,Alok(allal) wrote:
>> is my understanding correct?
>
> Yes.
>
> For completeness, I would like to point out that during outage of an
audit sink (in your example solr) there’s also a provision to spool to
local disk which should reduce the likelihood of lost events. For more
details refer:
>
https://cwiki.apache.org/confluence/display/RANGER/Ranger+0.5+Audit+Configuration#Ranger0.5AuditConfiguration-AuditQueues
>
https://cwiki.apache.org/confluence/display/RANGER/Ranger+0.5+Audit+Configuration#Ranger0.5AuditConfiguration-ConfigurationrelatedtoFilespooling
Super - thanks all for the clarifications.
