Cloudera Docs

Configuring auditing for Cloudera Lakehouse Optimizer

You can configure auditing for Cloudera Lakehouse Optimizer in Cloudera Manager by setting auditing properties on the Cloudera Lakehouse Optimizer service.

Ensure that the target filesystem URI is reachable from all Cloudera Lakehouse Optimizer service hosts and that the Cloudera Lakehouse Optimizer service principal has write access to the audit directory.
Configure auditing on every Cloudera Lakehouse Optimizer instance in the cluster or Data Hub.

To configure auditing on a Cloudera Lakehouse Optimizer instance:

  1. In Cloudera Manager > Clusters > [***CLOUDERA LAKEHOUSE OPTIMIZER***] > Configuration, set the following auditing properties:
    1. Set dlm.audit.enabled to true to enable auditing.
    2. Set dlm.audit.fs.uri to a production audit directory that is owned by the Cloudera Lakehouse Optimizer service principal.
      For example, hdfs:///user/dlm/audit-logs.
    3. Optionally, configure dlm.audit.push.interval.ms, dlm.audit.fs.rollover.time.ms, dlm.audit.fs.max.events.per.file, and dlm.audit.file.name.prefix based on your operational requirements.
    4. Optionally, configure dlm.audit.fs.file.permission and dlm.audit.fs.dir.permission for HDFS or local filesystem deployments.
    For the complete list of auditing properties, see Cloudera Lakehouse Optimizer auditing configuration properties.
  2. Restart the Cloudera Lakehouse Optimizer service.
  3. Verify that audit log files are created at the configured URI after you perform a Cloudera Lakehouse Optimizer operation.

After you configure auditing:

  • Monitor the application log for audit pipeline warnings if events are dropped.
  • Configure external retention or log shipping for rolled audit files.
  • On object stores, configure bucket versioning and restrictive IAM policies for tamper protection.