Audit logging in Hadoop - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable audit logging in Hadoop's core-site.xml.

Hadoop

<configuration>
  <property>
    <name>hadoop.security.authorization</name>
    <value>[1]</value>
  </property>
</configuration>

Drag options to blanks, or click blank then click option'

Afalse

Btrue

Cenabled

Don

Attempts:

3 left

💡 Hint

Common Mistakes

Setting the value to 'false' disables audit logging.

Using 'enabled' or 'on' are not valid values for this property.

Setting 'hadoop.security.authorization' to 'true' enables authorization checks and audit logging in Hadoop.

2fill in blank

medium

Complete the code to specify the audit log directory in hdfs-site.xml.

Hadoop

<configuration>
  <property>
    <name>dfs.namenode.audit.log.dir</name>
    <value>[1]</value>
  </property>
</configuration>

Drag options to blanks, or click blank then click option'

A/tmp/hadoop/audit

B/etc/hadoop/audit

C/var/log/hadoop/audit

D/home/hadoop/audit

Attempts:

3 left

💡 Hint

Common Mistakes

Using '/tmp' or '/home' directories which are not suitable for persistent logs.

Choosing configuration directories like '/etc' which are not meant for logs.

The audit logs are typically stored in '/var/log/hadoop/audit' directory for proper log management.

3fill in blank

hard

Fix the error in the audit logging configuration snippet to enable audit logging.

Hadoop

<configuration>
  <property>
    <name>hadoop.security.audit.log.enabled</name>
    <value>[1]</value>
  </property>
</configuration>

Drag options to blanks, or click blank then click option'

Atrue

Byes

Cenable

D1

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'enable' or 'yes' which are not recognized boolean values.

Using '1' which is not accepted as a boolean string in Hadoop configs.

The correct value to enable audit logging is 'true'. Other values like 'enable', 'yes', or '1' are invalid and cause errors.

4fill in blank

hard

Fill both blanks to configure audit logging for the NameNode and specify the log file name.

Hadoop

<configuration>
  <property>
    <name>dfs.namenode.audit.log.enabled</name>
    <value>[1]</value>
  </property>
  <property>
    <name>dfs.namenode.audit.log.filename</name>
    <value>[2]</value>
  </property>
</configuration>

Drag options to blanks, or click blank then click option'

Atrue

Bfalse

Caudit.log

Dnamenode.log

Attempts:

3 left

💡 Hint

Common Mistakes

Disabling audit logging by setting the first property to 'false'.

Using generic log filenames like 'namenode.log' which may mix audit logs with other logs.

Setting 'dfs.namenode.audit.log.enabled' to 'true' enables audit logging, and 'audit.log' is a common filename for audit logs.

5fill in blank

hard

Fill both blanks to create a dictionary comprehension that filters audit events with severity greater than INFO.

Hadoop

audit_events = {event: event['severity'] {BLANK_2}} 'INFO' for event in events if event['type'] == {{BLANK_2}}

Drag options to blanks, or click blank then click option'

A:

B>

C'AUDIT'

D==

Attempts:

3 left

💡 Hint

Common Mistakes

Using '==' instead of ':' in dictionary comprehension syntax.

Using '==' instead of '>' for severity comparison.

Filtering wrong event types or missing quotes around string literals.

The dictionary comprehension uses ':' to map keys to values, '>' to filter severity greater than 'INFO', and filters events of type 'AUDIT'.

Practice

1. What is the main purpose of audit logging in Hadoop?

easy

A. To backup data automatically

B. To improve data processing speed

C. To compress files for storage

D. To track user actions for security and troubleshooting

Solution

1. Step 1: Understand audit logging function

   Audit logging records user actions like access and changes in Hadoop.

2. Step 2: Identify main goal

   This helps with security checks and troubleshooting issues.

3. Final Answer:

   To track user actions for security and troubleshooting -> Option D

4. Quick Check:

   Audit logging = Track user actions [OK]

Hint: Audit logs = user actions tracking for security [OK]

Common Mistakes:

• Confusing audit logging with data backup
• Thinking audit logs speed up processing
• Mixing audit logging with file compression

2. Which configuration property must be set to true to enable audit logging in Hadoop?

easy

A. hadoop.logging.audit.enabled

B. hadoop.security.audit.enable

C. hadoop.audit.logging.active

D. hadoop.security.authorization

Solution

1. Step 1: Identify correct property name

   The official property to enable audit logging is hadoop.security.audit.enable.

2. Step 2: Confirm value to enable

   Setting it to true activates audit logging features.

3. Final Answer:

   hadoop.security.audit.enable -> Option B

4. Quick Check:

   Enable audit logging = hadoop.security.audit.enable true [OK]

Hint: Enable audit with hadoop.security.audit.enable true [OK]

Common Mistakes:

• Using incorrect property names
• Setting property to false
• Confusing audit logging with general logging

3. Given the following audit log entry:

2024-06-01 10:15:30 INFO User: alice accessed /data/input/file1.txt

What does this log entry indicate?

medium

A. User alice modified the file /data/input/file1.txt

B. User alice deleted the file /data/input/file1.txt

C. User alice accessed the file /data/input/file1.txt

D. User alice created the file /data/input/file1.txt

Solution

1. Step 1: Read the log message carefully

   The log states "User: alice accessed /data/input/file1.txt" which means alice opened or read the file.

2. Step 2: Understand the action word

   "accessed" means viewing or reading, not modifying or deleting.

3. Final Answer:

   User alice accessed the file /data/input/file1.txt -> Option C

4. Quick Check:

   Access means read/view, not modify [OK]

Hint: Look for action verb in log entry to know user activity [OK]

Common Mistakes:

• Assuming access means modification
• Confusing access with deletion
• Ignoring the exact log message wording

4. You enabled audit logging by setting hadoop.security.authorization to true, but no audit logs are generated. What is the most likely cause?

medium

A. Audit logger classes are not configured properly

B. Hadoop service is not running

C. User permissions are too high

D. Audit logging is disabled by default

Solution

1. Step 1: Check audit logging prerequisites

   Besides enabling authorization, audit logger classes must be configured to capture logs.

2. Step 2: Identify missing configuration

   If audit logger classes are missing or misconfigured, no logs will appear despite enabling authorization.

3. Final Answer:

   Audit logger classes are not configured properly -> Option A

4. Quick Check:

   Enable + configure logger classes = audit logs [OK]

Hint: Enable plus configure logger classes to get audit logs [OK]

Common Mistakes:

• Assuming service not running causes no logs
• Thinking user permissions block audit logs
• Ignoring need to configure logger classes

5. You want to audit all user actions on Hadoop files and see who changed data and when. Which combination of steps is correct?

hard

A. Set hadoop.security.authorization=true and configure audit logger classes

B. Set hadoop.security.authorization=false and enable debug logging

C. Only configure audit logger classes without enabling authorization

D. Enable file system replication and audit logging

Solution

1. Step 1: Enable security authorization

   Setting hadoop.security.authorization=true activates audit logging capability.

2. Step 2: Configure audit logger classes

   These classes capture and record user actions in logs.

3. Final Answer:

   Set hadoop.security.authorization=true and configure audit logger classes -> Option A

4. Quick Check:

   Enable authorization + logger classes = full audit [OK]

Hint: Enable authorization and logger classes for full audit [OK]

Common Mistakes:

• Disabling authorization but expecting audit logs
• Relying on debug logging for audit
• Confusing replication with audit logging