[
https://issues.apache.org/jira/browse/HDDS-98?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16591287#comment-16591287
]
Jitendra Nath Pandey commented on HDDS-98:
------------------------------------------
Its a good idea to put IP address as well. However, I would suggest put them at
the top level.
The reason is that many systems try to load audit logs in some form of schema,
with user and ip as two columns. This user is the guy making the remote call.
Having at top level will avoid the need of parsing the operation string.
Since we are already tracking SUCCESS/FAILURE for the call, a separate ERROR
field is not needed.
I would suggest to put SUCCESS/FAILURE as a separate column. Preferable to have
as flat a structure as possible, makes processing/querying easier.
See the example below:
2018-08-24 04:57:28,685 | OMAudit | 172.18.0.3 | anu | CREATE_VOLUME
[admin="xiaoyu" creationTime="0" owner="xiaoyu" quotaInBytes="1099511627776"
volume="xmen"] | SUCCESS
Extensibility: How would we add or remove fields from this in a backward
compatible way? We should support a key value format for stuff outside the
operation as well. NameNode puts everything, including user name and operation
in a key-value format.
One option:
2018-08-24 04:57:28,685 | OMAudit | 172.18.0.3 | anu | CREATE_VOLUME
[admin="xiaoyu" creationTime="0" owner="xiaoyu" quotaInBytes="1099511627776"
volume="xmen"] | SUCCESS | key1 = value1 | key2 = value2 ...
I guess, this key value stuff can be added later.
> Adding Ozone Manager Audit Log
> ------------------------------
>
> Key: HDDS-98
> URL: https://issues.apache.org/jira/browse/HDDS-98
> Project: Hadoop Distributed Data Store
> Issue Type: Sub-task
> Reporter: Xiaoyu Yao
> Assignee: Dinesh Chitlangia
> Priority: Major
> Labels: Logging, audit
> Fix For: 0.2.1
>
> Attachments: HDDS-98.001.patch, HDDS-98.002.patch, HDDS-98.003.patch,
> HDDS-98.004.patch, audit.log, log4j2.properties
>
>
> This ticket is opened to add ozone manager's audit log.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
