ranger-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Don Bosco Durai (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (RANGER-1780) Allow AuditSummaryQueue to aggregate events in the same directory
Date Mon, 25 Sep 2017 22:59:00 GMT

    [ https://issues.apache.org/jira/browse/RANGER-1780?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16179914#comment-16179914
] 

Don Bosco Durai commented on RANGER-1780:
-----------------------------------------

[~afernandez], thanks for your extension. I have added you as a contributor to Apache Ranger
and assigned this JIRA to you.

Can you also follow the guidelines from [https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=55151244]
to create a review board request.

I have some specific questions on your requirement. Do you feel having a global "parent" level
aggregation will be a bit harsh? I can understand, parent level folder for Hive table partition
folders. But with globally, we might lose some granularity. Honestly, I can't think of any
better way to configure this on selective resources, but I am open to suggestions.

Also, this code is very generic for all applications. The resource definition for Kafka might
be different than HDFS. So we might have to see we can address all of them.



> Allow AuditSummaryQueue to aggregate events in the same directory
> -----------------------------------------------------------------
>
>                 Key: RANGER-1780
>                 URL: https://issues.apache.org/jira/browse/RANGER-1780
>             Project: Ranger
>          Issue Type: Improvement
>          Components: audit
>    Affects Versions: 0.7.1
>            Reporter: Alejandro Fernandez
>            Assignee: Alejandro Fernandez
>             Fix For: 1.0.0
>
>         Attachments: RANGER-1780.patch, ranger_summary.png
>
>
> AuditSummaryQueue already has logic to enable the summarization, but it requires 2 events
to have the exact same resource path (plus a couple of other fields such as user, access type,
access result, action, client ip, session).
> This Jira is to add a config called xasecure.audit.provider.summary.aggregate.level so
that if it is set to "directory" then 2 events can still be aggregated if they are files in
the same directory.
> If the config is not specified its default value will be "file" which preserves the existing
behavior.
> See [^ranger_summary.png] for screenshot on desired behavior.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

Mime
View raw message