Cloudera Docs

Downloading Audit Events

You can download audit events in CSV formats.

  1. Specify desired filters and time range.
  2. Click the Download CSV button.
    A file with the following fields is downloaded: service, username, command, ipAddress, resource, allowed, timestamp, operationText. The structure of the resource field depends on the type of the service:
    • HDFS - A file path
    • Hive, Hue, and Impala - database:tablename
    • HBase - table family:qualifier

    For Hive, Hue, and Impala query and load commands, operationText is the query string.

HDFS Service Audit Log

service,username,command,ipAddress,resource,allowed,timestamp
hdfs1,cloudera,setPermission,10.20.187.242,/user/hive,false,"2013-02-09T00:59:34.430Z"
hdfs1,cloudera,getfileinfo,10.20.187.242,/user/cloudera,true,"2013-02-09T00:59:22.667Z"
hdfs1,cloudera,getfileinfo,10.20.187.242,/,true,"2013-02-09T00:59:22.658Z"

In this example, the first event access was denied, and therefore the allowed field has the value false.