Audit logging in Hadoop - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Audit log file content after enabling HDFS audit logging

You enabled audit logging in HDFS by setting dfs.namenode.audit.log.enabled=true in hdfs-site.xml. After restarting the NameNode, you perform a file read operation. What will you find in the audit log file?

A A summary of all file system operations without user details.

B Only error messages related to failed operations.

C No entries until the DataNode logs are checked.

D A log entry showing the user, operation type (READ), file path, and timestamp.

💡 Hint

Audit logs record detailed info about each operation including user and action.

When audit logging is enabled in HDFS, each file system operation like READ or WRITE is logged with details such as user, operation type, file path, and timestamp in the audit log file.

❓ Configuration

intermediate

Configuring audit logging in Hadoop's hdfs-site.xml

Which configuration snippet correctly enables audit logging for the NameNode in Hadoop?

A

<property>
  <name>dfs.namenode.audit.log.enabled</name>
  <value>true</value>
</property>

B

<property>
  <name>dfs.datanode.audit.log.enabled</name>
  <value>true</value>
</property>

C

<property>
  <name>dfs.audit.logging</name>
  <value>enabled</value>
</property>

D

<property>
  <name>dfs.namenode.audit.enable</name>
  <value>yes</value>
</property>

💡 Hint

The correct property name is specific and must be exact.

The correct property to enable audit logging on the NameNode is dfs.namenode.audit.log.enabled set to true. Other options are incorrect property names or values.

❓ Troubleshoot

advanced

Why are no audit logs generated despite enabling audit logging?

You set dfs.namenode.audit.log.enabled=true and restarted the NameNode, but no audit logs appear in the expected directory. What is the most likely cause?

A The property must be set in <code>core-site.xml</code>, not <code>hdfs-site.xml</code>.

B Audit logging only works on DataNodes, not NameNodes.

C The NameNode user does not have write permission to the audit log directory.

D Audit logs are only generated if the cluster is in safe mode.

💡 Hint

Check file system permissions for the log directory.

If the NameNode process user lacks write permission to the audit log directory, logs cannot be created even if audit logging is enabled.

✅ Best Practice

advanced

Best practice for managing audit log file size in Hadoop

What is the recommended way to manage audit log file size to prevent disk space issues?

A Configure log rotation using tools like logrotate to archive and compress old audit logs.

B Store audit logs on the same disk as HDFS data for faster access.

C Manually delete audit logs once a week without backups.

D Disable audit logging during peak hours to reduce log size.

💡 Hint

Automated log rotation helps keep logs manageable and safe.

Using log rotation tools to archive and compress audit logs regularly is the best practice to prevent disk space exhaustion and maintain logs safely.

🔀 Workflow

expert

Sequence of steps to enable and verify audit logging in Hadoop HDFS

Arrange the following steps in the correct order to enable and verify audit logging on the Hadoop NameNode.

A 3,1,2,4

B 1,2,3,4

C 1,3,2,4

D 2,1,3,4

💡 Hint

Configuration changes require restart before testing and verification.

First configure audit logging, then restart NameNode to apply changes, perform an operation to generate logs, and finally check the audit log file.

Practice

1. What is the main purpose of audit logging in Hadoop?

easy

A. To backup data automatically

B. To improve data processing speed

C. To compress files for storage

D. To track user actions for security and troubleshooting

Solution

1. Step 1: Understand audit logging function

   Audit logging records user actions like access and changes in Hadoop.

2. Step 2: Identify main goal

   This helps with security checks and troubleshooting issues.

3. Final Answer:

   To track user actions for security and troubleshooting -> Option D

4. Quick Check:

   Audit logging = Track user actions [OK]

Hint: Audit logs = user actions tracking for security [OK]

Common Mistakes:

• Confusing audit logging with data backup
• Thinking audit logs speed up processing
• Mixing audit logging with file compression

2. Which configuration property must be set to true to enable audit logging in Hadoop?

easy

A. hadoop.logging.audit.enabled

B. hadoop.security.audit.enable

C. hadoop.audit.logging.active

D. hadoop.security.authorization

Solution

1. Step 1: Identify correct property name

   The official property to enable audit logging is hadoop.security.audit.enable.

2. Step 2: Confirm value to enable

   Setting it to true activates audit logging features.

3. Final Answer:

   hadoop.security.audit.enable -> Option B

4. Quick Check:

   Enable audit logging = hadoop.security.audit.enable true [OK]

Hint: Enable audit with hadoop.security.audit.enable true [OK]

Common Mistakes:

• Using incorrect property names
• Setting property to false
• Confusing audit logging with general logging

3. Given the following audit log entry:

2024-06-01 10:15:30 INFO User: alice accessed /data/input/file1.txt

What does this log entry indicate?

medium

A. User alice modified the file /data/input/file1.txt

B. User alice deleted the file /data/input/file1.txt

C. User alice accessed the file /data/input/file1.txt

D. User alice created the file /data/input/file1.txt

Solution

1. Step 1: Read the log message carefully

   The log states "User: alice accessed /data/input/file1.txt" which means alice opened or read the file.

2. Step 2: Understand the action word

   "accessed" means viewing or reading, not modifying or deleting.

3. Final Answer:

   User alice accessed the file /data/input/file1.txt -> Option C

4. Quick Check:

   Access means read/view, not modify [OK]

Hint: Look for action verb in log entry to know user activity [OK]

Common Mistakes:

• Assuming access means modification
• Confusing access with deletion
• Ignoring the exact log message wording

4. You enabled audit logging by setting hadoop.security.authorization to true, but no audit logs are generated. What is the most likely cause?

medium

A. Audit logger classes are not configured properly

B. Hadoop service is not running

C. User permissions are too high

D. Audit logging is disabled by default

Solution

1. Step 1: Check audit logging prerequisites

   Besides enabling authorization, audit logger classes must be configured to capture logs.

2. Step 2: Identify missing configuration

   If audit logger classes are missing or misconfigured, no logs will appear despite enabling authorization.

3. Final Answer:

   Audit logger classes are not configured properly -> Option A

4. Quick Check:

   Enable + configure logger classes = audit logs [OK]

Hint: Enable plus configure logger classes to get audit logs [OK]

Common Mistakes:

• Assuming service not running causes no logs
• Thinking user permissions block audit logs
• Ignoring need to configure logger classes

5. You want to audit all user actions on Hadoop files and see who changed data and when. Which combination of steps is correct?

hard

A. Set hadoop.security.authorization=true and configure audit logger classes

B. Set hadoop.security.authorization=false and enable debug logging

C. Only configure audit logger classes without enabling authorization

D. Enable file system replication and audit logging

Solution

1. Step 1: Enable security authorization

   Setting hadoop.security.authorization=true activates audit logging capability.

2. Step 2: Configure audit logger classes

   These classes capture and record user actions in logs.

3. Final Answer:

   Set hadoop.security.authorization=true and configure audit logger classes -> Option A

4. Quick Check:

   Enable authorization + logger classes = full audit [OK]

Hint: Enable authorization and logger classes for full audit [OK]

Common Mistakes:

• Disabling authorization but expecting audit logs
• Relying on debug logging for audit
• Confusing replication with audit logging