Configuring Ranger audits to show actual client IP address
How to forward the actual client IP address to audit logs generated from a Ranger plugin.
Ranger audit logs record the IP address through which Ranger policies grant/authorize access. When Ranger is set up behind a Knox proxy server, the proxy server IP address appears in the audit logs generated for each Ranger plugin. You can configure each plugin to forward the actual client IP address on which that service runs, so that the audit logs for that service more specifically reflect access/authorization activity. You must configure each plugin individually. This topic uses the Hive (Hadoop SQL) service as an example.
- From Cloudera Manager choose .
- In Return. , type ranger-plugin, then press
- In Ranger Plugin Use X-Forwarded for IP Address, check the box.
In Ranger Plugin Trusted Proxy IP Address, type the IP
address of the Knox proxy server host.