Downloading Audit Events

You can download audit events in CSV formats.

  1. Specify desired filters and time range.
  2. Click the Download CSV button.
    A file with the following fields is downloaded: service, username, command, ipAddress, resource, allowed, timestamp, operationText. The structure of the resource field depends on the type of the service:
    • HDFS - A file path
    • Hive, Hue, and Impala - database:tablename
    • HBase - table family:qualifier

    For Hive, Hue, and Impala query and load commands, operationText is the query string.

HDFS Service Audit Log


In this example, the first event access was denied, and therefore the allowed field has the value false.