Operations Audit
When you perform an operation using Ambari, such as user login or logout, stopping or starting a service, and adding or removing a service, Ambari creates an entry in an audit log. By reading the audit log, you can determine who performed the operation, when the operation occurred, and other, operation-specific information. You can find the Ambari audit log on your Ambari server host, at:
/var/log/ambari-server/ambari-audit.log
When you change configuration for a service, Ambari creates an entry in the audit log, and creates a specific log file, at:
ambari-config-changes.log
By reading the configuration change log, you can find out even more information about each change. For example:
2016-05-25 18:31:26,242 INFO - Cluster 'MyCluster' changed by: 'admin'; service_name='HDFS' config_group='default' config_group_id='-1' version='2'
More Information