Manually Updating Solr Audit Settings
You can save and store Ranger audits to Solr if you have installed and configured the Solr service in your cluster.
It is recommended that Ranger audits be written to both Solr and HDFS. Audits to Solr are primarily used to enable queries from the Ranger Admin UI. HDFS is a long-term destination for audits -- audits stored in HDFS can be exported to any SIEM system, or to another audit store.
![[Note]](../common/images/admon/note.png) | Note |
|---|---|
If you enabled Solr Audits as part of the standard Ambari installation procedure, audits to Solr are activated automatically when Ranger is enabled for a plugin. |
To save Ranger audits to Solr:
From the Ambari dashboard, select the Ranger service. On the Configs tab, scroll down and select Advanced ranger-admin-site. Set the following property values:
ranger.audit.source.type = solrranger.audit.solr.urls = http://solr_host:6083/solr/ranger_auditsranger.audit.solr.username = ranger_solrranger.audit.solr.password = NONE
Restart the Ranger service.
After the Ranger service has been restarted, you will then need to make specific configuration changes for each plugin to ensure that the plugin's data is captured in Solr.
For example, if you would like to configure HBase for audits to Solr, perform the following steps:
Select the Audit to Solr checkbox in Advanced ranger-hbase-audit.
Enable the Ranger plugin for HBase.
Restart the HBase component.
Verify that the Ranger audit logs are being passed to Solr by opening one of the following URLs in a web browser:
http://{RANGER_HOST_NAME}:6080/index.html#!/reports/audit/bigData
http://{SOLR_HOST}:6083/solr/ranger_audits