Skip to content

Admin Audit Forwarding

Ranger emits an admin audit event for every administrative action performed through the Privacera Portal or the Ranger REST API — including policy creation, modification, and deletion; user and group management; role and tag changes; and other configuration updates. By default, Privacera stores these events only in its database. Enabling forwarding sends them to Solr (for search and dashboards) and to S3 via the Audit Server's Fluentd pipeline (for long-term retention, compliance archiving, and downstream analytics).

Where Admin Audits Are Stored

Destination Default state Notes
Privacera database (x_trx_log table) Always enabled Authoritative record; always available regardless of external audit infrastructure.
Solr (admin_audits collection) Disabled Enables search and Portal dashboards. Requires access-audit Solr to be enabled first — see Dependency on Access-Audit Solr.
S3 / cloud storage via Fluentd Disabled Long-term retention and analytics. Requires AUDIT_FLUENTD_ENABLE: "true" in vars.audit-fluentd.yml.

Enabling Admin Audit Forwarding

PrivaceraCloud

PrivaceraCloud enables admin audit forwarding to Privacera-managed storage by default; no additional configuration is required.

Self-Managed deployments disable forwarding by default. To enable Solr forwarding, copy the ready-made sample file:

Steps

  1. SSH into the instance where Privacera Manager is installed.

  2. Navigate to the config directory:

    Bash
    1
    cd ~/privacera/privacera-manager/config

  3. Copy the sample file if it does not already exist:

    Bash
    1
    cp -n sample-vars/vars.admin-audit.solr.yml custom-vars/

  4. Open the file for editing:

    Bash
    1
    vi custom-vars/vars.admin-audit.solr.yml

  5. Confirm or set the properties you need. This file controls Solr forwarding. S3 forwarding via Fluentd is enabled automatically when AUDIT_FLUENTD_ENABLE: "true" is set in vars.audit-fluentd.yml — no additional flag is required. The minimal configuration to enable Solr forwarding is:

    YAML
    1
2
    ## Enable forwarding to Solr
ADMIN_AUDITS_SOLR_DESTINATION: "true"

    The URL and spool-directory properties below are pre-configured with sensible defaults. Override them only if your deployment uses non-default paths.

  6. After saving the file, restart the services:

    Bash
    1
2
3
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
./pm_with_helm.sh upgrade

Dependency on Access-Audit Solr

ADMIN_AUDITS_SOLR_DESTINATION: "true" flows through ADMIN_AUDITSERVER_SOLR_DESTINATION in auditserver.yml and is rendered only when AUDITSERVER_SOLR_DESTINATION is also "true" — meaning the access-audit Solr destination must be enabled before the admin-audit Solr block is written. If access-audit Solr is not yet enabled, set it in vars.audit-fluentd.yml:

YAML
1
AUDITSERVER_SOLR_DESTINATION: "true"

Configuration Reference

vars.admin-audit.solr.yml — Admin Audit Properties

Property Default Description
ADMIN_AUDITS_SOLR_DESTINATION "false" Set to "true" to forward admin audit events from Ranger to the Solr admin_audits collection. Requires AUDITSERVER_SOLR_DESTINATION: "true" in vars.audit-fluentd.yml — see Dependency on Access-Audit Solr.
ADMIN_AUDITSERVER_HTTP_ENABLE "false" Set to "true" to forward admin audit events over HTTP to a custom (non-Fluentd) endpoint. Not required for S3 forwarding — when AUDIT_FLUENTD_ENABLE: "true" is set in vars.audit-fluentd.yml, admin audits flow to S3 via Fluentd automatically.
ADMIN_AUDITSERVER_HTTP_URLS Auto-resolved from AUDIT_FLUENTD_INTERNAL_URL/admin_audits when Fluentd is enabled; empty otherwise HTTP endpoint(s) where admin audit events are posted. Set this explicitly only when not using Fluentd.
ADMIN_AUDITSERVER_HTTP_SPOOL_DIR "/workdir/privacera-audit-server/spool/admin-http-spool" Local spool directory used to buffer events when HTTP delivery fails.

Note

When AUDIT_FLUENTD_ENABLE: "true" is set in vars.audit-fluentd.yml, admin audit events are forwarded to S3 via Fluentd automatically — no additional property in vars.admin-audit.solr.yml is needed. ADMIN_AUDITSERVER_HTTP_URLS auto-resolves from AUDIT_FLUENTD_INTERNAL_URL/admin_audits, and the template's if ADMIN_AUDITSERVER_HTTP_URLS else 'false' guard prevents writing a blank URL when Fluentd is not configured.

Solr Collection URL

The admin Solr collection URL defaults to {{SOLR_URL}}/solr/admin_audits and is controlled by ADMIN_AUDITSERVER_SOLR_URLS in auditserver.yml. No override is required unless your collection name differs from the default admin_audits.

Fluentd Routing

Admin audit events posted to the /admin_audits HTTP endpoint are routed by <match admin_audits> blocks in each Fluentd backend configuration. Events are stored under the path pattern audits/json/auditType=admin_audits/year=%Y/month=%m/day=%d/ in all cloud-storage backends.

Backend Buffer Path
S3 /fluentd/log/s3/admin_audits_*
GCS /fluentd/log/gcs/admin_audits_*
Azure ADLS /fluentd/log/admin-audits-azure-adls/admin_audits_*
Azure Blob /fluentd/log/admin-audits-azure-blob/admin_audits_*
Local In-memory / file output (no explicit buffer path)

All cloud backends store events as gzip-compressed JSON. The Local backend uses raw JSON file output.