Skip to content

Audit Log JSON Format

This page documents the JSON structure of access audit events collected by the Audit Server from Apache Ranger plugins and Privacera services. These events are typically stored in Apache Solr and can also be forwarded to sinks like S3.

Sample Event

JSON
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "id": "b9e5024f-f9d4-445d-b35a-cf1e10d8d375-3",
  "access": "read",
  "enforcer": "ranger-acl",
  "agent": "dataserver",
  "repo": "privacera_s3",
  "reqUser": "cve.fix",
  "resource": "ythu-test-bk/17oct22_crossAc_ETL/RTP/arch/finance_us.parquet",
  "cliIP": "172.31.53.178",
  "logType": "RangerAudit",
  "result": 1,
  "policy": 4842,
  "repoType": 333,
  "resType": "objectpath",
  "action": "read",
  "evtTime": "2025-08-18T09:47:57.369+00:00",
  "seq_num": 7,
  "event_count": 1,
  "event_dur_ms": 1,
  "cluster": "dataserver",
  "agentHost": "dataserver-7b94b4ffd-dzvzx",
  "policyVersion": 3,
  "tenant_id": "17540596620015",
  "auditType": "__access_audit__",
  "_ttl_": "+30DAYS",
  "_expire_at_": "2025-09-17T09:48:07.387+00:00",
  "_version_": 1840786164866351104,
  "policyName": "all - bucketname, objectpath",
  "repoDisplayName": "privacera_s3"
}

Field Reference

Field Description Example Type
id Unique identifier of the audit event 85f0f6d7-2415-44e6-b277-6751d6c86ac7-3 String
policyVersion / policy_version Policy version used during authorization 3 Number
result Access result (1 = Allowed, 0 = Denied) 1 Number
access Access type evaluated READ, WRITE, SELECT String
cliType Client type HiveServer, HiveMetaStore String
agent Plugin/agent that enforced authorization hdfs, hiveserver2, hbase, dataserver String
enforcer Access enforcer hadoop-acl, ranger-acl String
sess Session ID 606b0764-7914-4f32-8343-04d8be6e5bd5 String
cliIP Client IP address 10.0.0.1 String
policy Policy ID matched for the resource 4842 Number
repo Repository name (service) privacera_s3 String
repoDisplayName Repository display name privacera_s3 String
repoType Repository type (service type enum) 333 Number
reason Reason for result (if any) Access denied due to ... String
evtTime Event timestamp (request time) 2025-08-18T09:47:57.369+00:00 datetime (ISO 8601)
reqUser Requesting user ranger String
action Operation performed QUERY, read, write String
resource Resource path testdb/testtable/column1 String
resType Type of accessed resource @column, objectpath String
seq_num Sequence number within a session 7 Number
event_count Count of similar events in interval 3 Number
event_dur_ms Event execution time (ms) 10 Number
tags Tags associated to resource/policy ["PCI"] array[string]
additional_info Additional details (forwarded address, remote address, etc.) {"forwardedFor":"..."} Map[String,String]
cluster_name Cluster where the request originated Cluster 1 String
zone_name Security zone for the request (if applicable) Zone A String
agentHost Agent hostname test-hbase-0710-1.openstacklocal String
logType Logical log type RangerAudit String
auditType Audit type identifier access_audit String
tenant_id Tenant identifier (multi-tenant deployments) 17540596620015 String
policyName Name of the matched policy all - bucketname, objectpath String
ttl Time to live in sink (Solr) +30DAYS String
expire_at Computed expiry timestamp in sink 2025-09-17T09:48:07.387+00:00 String
version Sink/internal version (e.g., Solr doc version) 1840786164866351104 Number

Optional fields (may appear in some deployments)

  • datasets: Set of dataset identifiers associated with the event
  • projects: Set of project identifiers associated with the event
  • account_id / accountId: Cloud account identifier
  • account_name / accountName: Cloud account name
  • workspace_id / workspaceId: Workspace identifier
  • workspace_name / workspaceName: Workspace name
  • cluster: Cluster name alias (may duplicate cluster_name in some agents)

Notes

  • Result semantics: 1 = Allowed, 0 = Denied.
  • Time format: evtTime is ISO 8601 with timezone offset or Z (e.g., 2025-08-18T09:47:57.369Z).
  • repoType: Numeric enum of service type; concrete values are service-specific.
  • TTL/Expiry: ttl and expire_at are managed by the sink (e.g., Solr) and may be set by retention policies.
  • Key aliases: Some fields exist in both snake_case and camelCase depending on producer; both are supported by the Audit Server pipeline (e.g., policy_version/policyVersion).
  • Tagging: tags are derived from Ranger tag-based policies and/or resource classifications when available.