[
https://issues.apache.org/jira/browse/HDFS-3535?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13401641#comment-13401641
]
Andy Isaacson commented on HDFS-3535:
-------------------------------------
{quote}
Why? Doesn't seem like the arg evaluation has side effects or is expensive but
maybe I'm missing something.
{quote}
{code}
FSNamesystem.java- final HdfsFileStatus stat = dir.getFileInfo(src,
false);
FSNamesystem.java: logAuditEvent(UserGroupInformation.getCurrentUser(),
...
FSNamesystem.java- final HdfsFileStatus stat = dir.getFileInfo(src, false);
FSNamesystem.java: logAuditEvent(UserGroupInformation.getCurrentUser(),
...
FSNamesystem.java- StringBuilder cmd = new StringBuilder("rename
options=");
FSNamesystem.java- for (Rename option : options) {
FSNamesystem.java- cmd.append(option.value()).append(" ");
FSNamesystem.java- }
FSNamesystem.java: logAuditEvent(UserGroupInformation.getCurrentUser(),
Server.getRemote
{code}
{quote}
Agree this cleanup should be a separate change, file a jira?
{quote}
Sure, filed HDFS-3569.
> Audit logging should log denied accesses
> ----------------------------------------
>
> Key: HDFS-3535
> URL: https://issues.apache.org/jira/browse/HDFS-3535
> Project: Hadoop HDFS
> Issue Type: New Feature
> Components: name-node
> Affects Versions: 2.0.0-alpha
> Reporter: Andy Isaacson
> Assignee: Andy Isaacson
> Fix For: 2.0.1-alpha
>
> Attachments: hdfs-3535-1.txt, hdfs-3535-2.txt, hdfs-3535.txt
>
>
> FSNamesystem.java logs an audit log entry when a user successfully accesses
> the filesystem:
> {code}
> logAuditEvent(UserGroupInformation.getLoginUser(),
> Server.getRemoteIp(),
> "concat", Arrays.toString(srcs), target, resultingStat);
> {code}
> but there is no similar log when a user attempts to access the filesystem and
> is denied due to permissions. Competing systems do provide such logging of
> denied access attempts; we should too.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
