AuditsResource Resource

GET /audits

Fetch audit events from Cloudera Manager (CM) and CM managed services like HDFS, HBase, Impala, Hive, and Sentry.

By default, this call will fetch the first 100 audit events (sorted from most recent to oldest) corresponding to a 1 day window based on provided end time (which defaults to the current CM server time). The startTime and endTime parameters can be used to control the window being queried.

Audit events for CM managed services are only retrieved if Cloudera Navigator server is running.

Request Parameters
name type description default
endTime query End of the period to query in ISO 8601 format (defaults to current time). now
maxResults query Maximum number of audits to return 100
query query The query to filter out audits in the system. It accepts querying the intersection of a list of constraints, joined together with semicolons (without spaces). For example:

command==listStatus
looks for audits with listStatus command.
command==listStatus;username!=foo
looks for audits with listStatus command but excludes audits generated by foo username
command==listStatus;source==*oozie*
looks for audits with listStatus command and source that contains the string 'oozie'.
Following are valid selectors for the query (if applicable to the audit):
Selector Description SCM HDFS HBase Hive Impala Sentry
service Cloudera Manager Service x x x x x x
operation Operation name x x x x x x
username User name x x x x x x
impersonator Impersonator x x x x x
ip_address IP Address x x x x x x
allowed Whether the request was allowed or denied x x x x x x
qualifier Column qualifier x
source Source resource of the operation x x x x x
destination Destination resource of the operation x x x x
hostIpAddress Host IP Address x
role Cloudera Manager Role x
family Column family x
database_name Database name x x x
table_name Table name x x x x
object_type Type of object being handled x x x
operation_text Command/query text x x x

The only supported operator is ";" (Boolean AND). Boolean OR is not supported.

The supported comparators are == and != Note that "LIKE" comparison is supported using the wild card syntax, for example foo==*value*. Asterisk is interpreted as a wild card character and must not be part of the value. (LIKE comparison queries are converted to standard SQL LIKE syntax, so any % (%25) character in a value that also contains a wild card will be interpreted as a wild card.)

Available since API v8. A subset of these features is available since v4.

 n/a
resultOffset query Offset of audits to return 0
startTime query Start of the period to query in ISO 8601 format (defaults to 1 day ago relative to endTime). n/a
Response Body
media type data type description
application/json ApiAuditList (JSON) List of audits in descending order of timestamp

GET /audits/stream

Request Parameters
name type description default
endTime query now
maxResults query 100
query query n/a
resultOffset query 0
startTime query n/a
Response Body
media type data type
application/json object (JSON)