Audit logging in Apache Airflow - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Purpose of Audit Logging in Airflow

What is the main purpose of enabling audit logging in Apache Airflow?

A To track user actions and changes for security and compliance purposes

B To improve the speed of DAG execution by caching logs

C To automatically retry failed tasks without manual intervention

D To reduce the storage space used by logs by compressing them

💡 Hint

Think about why organizations need to keep records of who did what and when.

Audit logging records user actions and system changes, helping with security audits and compliance. It does not affect execution speed or retry logic.

💻 Command Output

intermediate

Output of Enabling Audit Logging in Airflow Config

What is the expected output or effect after setting audit_logging = True in the Airflow configuration file airflow.cfg and restarting the scheduler?

Apache Airflow

[logging]
audit_logging = True

A Airflow logs user actions like DAG runs and task state changes in the audit log file

B Airflow scheduler fails to start due to invalid config

C Airflow disables all other logs except audit logs

D Airflow automatically archives old logs to cloud storage

💡 Hint

Enabling audit logging should add extra logging, not remove or break existing features.

Setting audit_logging = True enables detailed logging of user actions and system changes, which are saved in audit logs. It does not disable other logs or cause errors.

❓ Configuration

advanced

Configuring Audit Logging to Use JSON Format

Which configuration snippet correctly sets up Airflow audit logging to output logs in JSON format for easier parsing?

A

[logging]
audit_logging = True
audit_log_format = plain_text

B

[logging]
audit_logging = True
audit_log_format = json

C

[logging]
audit_logging = False
audit_log_format = json

D

[logging]
audit_logging = True
audit_log_format = xml

💡 Hint

Audit logging must be enabled and the format set to 'json' exactly.

To output audit logs in JSON, audit_logging must be true and audit_log_format set to 'json'. Other formats or disabling audit logging will not produce JSON logs.

❓ Troubleshoot

advanced

Diagnosing Missing Audit Logs

You enabled audit logging in Airflow but notice no audit logs are being generated. Which of the following is the most likely cause?

A The Airflow webserver is not running

B The DAGs are not scheduled to run

C The Airflow user does not have write permissions to the audit log directory

D The airflow.cfg file is missing the <code>executor</code> setting

💡 Hint

Think about what could prevent logs from being saved even if logging is enabled.

If the Airflow process cannot write to the audit log directory due to permissions, no audit logs will be created. DAG scheduling or webserver status does not directly affect audit log creation.

🔀 Workflow

expert

Audit Logging Workflow for Compliance

Which sequence correctly describes the workflow for using Airflow audit logs to investigate a suspicious DAG modification?

A 3,2,1,4

B 2,1,3,4

C 1,3,2,4

D 1,2,3,4

💡 Hint

Think about the logical order from setup to investigation to action.

The correct workflow starts with enabling audit logging, then locating logs, searching for events, and finally reviewing and acting on findings.

Practice

1. What is the main purpose of audit logging in Apache Airflow?

easy

A. To speed up task execution

B. To manage Airflow plugins

C. To store DAG definitions

D. To record user actions for security and troubleshooting

Solution

1. Step 1: Understand audit logging concept

   Audit logging is designed to keep track of user actions and system events.

2. Step 2: Identify its purpose in Airflow

   This helps with security monitoring and troubleshooting issues by reviewing what happened.

3. Final Answer:

   To record user actions for security and troubleshooting -> Option D

4. Quick Check:

   Audit logging = record user actions [OK]

Hint: Audit logs track user actions for security [OK]

Common Mistakes:

• Confusing audit logs with performance logs
• Thinking audit logs store DAG code
• Assuming audit logs speed up tasks

2. Which section in airflow.cfg should you modify to enable audit logging?

easy

A. [core]

B. [logging]

C. [scheduler]

D. [webserver]

Solution

1. Step 1: Locate airflow.cfg configuration file

   This file contains sections for different Airflow components.

2. Step 2: Identify the section for logging settings

   The [logging] section controls log-related configurations including audit logging.

3. Final Answer:

   [logging] -> Option B

4. Quick Check:

   Audit logging config is under [logging] [OK]

Hint: Audit logging is set in [logging] section [OK]

Common Mistakes:

• Choosing [core] which is for general settings
• Selecting [scheduler] which controls scheduling
• Picking [webserver] which manages UI settings

3. Given this snippet from airflow.cfg:

[logging]
audit_log_enabled = True
audit_log_location = /var/log/airflow/audit.log

What will happen when a user triggers a DAG run?

medium

A. User action will be recorded in /var/log/airflow/audit.log

B. DAG will fail to start due to missing audit log

C. No audit log will be created because audit_log_enabled is False

D. Audit logs will be stored in the default Airflow logs folder

Solution

1. Step 1: Check audit_log_enabled value

   It is set to True, so audit logging is active.

2. Step 2: Check audit_log_location setting

   Logs will be saved to /var/log/airflow/audit.log as specified.

3. Final Answer:

   User action will be recorded in /var/log/airflow/audit.log -> Option A

4. Quick Check:

   Enabled True + location set = logs saved there [OK]

Hint: Enabled True means logs go to specified location [OK]

Common Mistakes:

• Assuming logs go to default folder ignoring config
• Thinking audit_log_enabled is False
• Believing DAG fails without audit log

4. You enabled audit logging but no logs appear in the specified file. Which is the most likely cause?

medium

A. Airflow scheduler is not running

B. audit_log_enabled is set to False

C. The audit_log_location path is incorrect or lacks write permission

D. DAGs are not defined properly

Solution

1. Step 1: Verify audit_log_enabled setting

   If it was False, no logs would be created, but question states it is enabled.

2. Step 2: Check file path and permissions

   If the path is wrong or Airflow lacks permission to write, logs won't appear.

3. Final Answer:

   The audit_log_location path is incorrect or lacks write permission -> Option C

4. Quick Check:

   Wrong path or no write permission blocks logs [OK]

Hint: Check file path and permissions first [OK]

Common Mistakes:

• Assuming scheduler not running causes no audit logs
• Blaming DAG definitions for audit logging issues
• Ignoring file system permissions

5. You want to ensure audit logs do not fill up disk space. Which approach is best to manage audit logging in Airflow?

hard

A. Configure log rotation on the audit_log_location file

B. Disable audit logging completely

C. Store audit logs in the Airflow database

D. Manually delete audit logs daily

Solution

1. Step 1: Understand audit log growth risk

   Audit logs can grow large and fill disk space if unmanaged.

2. Step 2: Choose best management method

   Configuring log rotation automatically archives and deletes old logs safely.

3. Step 3: Evaluate other options

   Disabling logs loses audit trail; storing in DB is not default; manual deletion is error-prone.

4. Final Answer:

   Configure log rotation on the audit_log_location file -> Option A

5. Quick Check:

   Log rotation prevents disk full from audit logs [OK]

Hint: Use log rotation to manage audit log size [OK]

Common Mistakes:

• Disabling audit logs instead of managing size
• Relying on manual deletion which is unreliable
• Assuming database storage is default or better