Skip to content

Session Audit Forwarding

Ranger emits a session audit event for every login attempt and every session refresh — whether the request originates from the Privacera Portal or from a client calling the Ranger REST API directly. By default, Privacera stores these events only in its database. Enabling forwarding sends them to S3 via the Audit Server's Fluentd pipeline for long-term retention, compliance archiving, and downstream analytics.

Where Session Audits Are Stored

Session audit events are persisted in two places:

  • Privacera database — every event is written to the x_auth_sess table immediately after the login attempt. This is the authoritative record and is always available regardless of external audit infrastructure.
  • S3 (object storage) — events are forwarded through the Privacera Audit Server pipeline and stored in S3 for long-term retention, compliance archiving, and downstream analytics. The S3 path is partitioned by date so events can be queried efficiently with tools like Apache Spark or Trino. On PrivaceraCloud this destination is enabled by default. In Self-Managed deployments it must be explicitly enabled — see Enabling Session Audit Forwarding below.

Enabling Session Audit Forwarding

PrivaceraCloud

PrivaceraCloud enables session audit forwarding to Privacera-managed S3 storage by default; no additional configuration is required.

Self-Managed deployments disable forwarding by default. To enable it, set the master gate property in vars.auditserver.yml and ensure the Audit Server's Fluentd pipeline is running.

Steps

  1. SSH into the instance where Privacera Manager is installed.

  2. Navigate to the config directory:

    Bash
    1
    cd ~/privacera/privacera-manager/config

  3. Copy the sample file if it does not already exist:

    Bash
    1
    cp -n sample-vars/vars.auditserver.yml custom-vars/

  4. Open the file for editing:

    Bash
    1
    vi custom-vars/vars.auditserver.yml

  5. Enable session audit forwarding by uncommenting and setting:

    YAML
    1
    AUDITSERVER_SESSION_AUDIT_ENABLE: "true"

    The remaining properties listed below are pre-configured with sensible defaults. Override them only if your deployment requires non-default paths or URLs.

  6. After saving the file, restart the services:

    Bash
    1
2
3
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
./pm_with_helm.sh upgrade

Configuration Reference

auditserver.yml — Session Audit Properties

Property Default Description
AUDITSERVER_SESSION_AUDIT_ENABLE "false" Master gate to enable or disable session audit forwarding. Set to "true" to activate the pipeline.
AUDITSERVER_SESSION_AUDIT_IS_ENABLED "{{AUDITSERVER_SESSION_AUDIT_ENABLE}}" Inherits the gate value; controls session.xasecure.audit.is.enabled in audit.properties.
AUDITSERVER_SESSION_AUDIT_DESTINATION_HTTP "{{AUDITSERVER_SESSION_AUDIT_ENABLE}}" Inherits the gate value; enables HTTP as a delivery destination.
AUDITSERVER_SESSION_AUDIT_DESTINATION_HTTP_IS_ENABLED "{{AUDITSERVER_SESSION_AUDIT_ENABLE}}" Inherits the gate value; mirrors the HTTP destination enabled flag.
AUDITSERVER_SESSION_AUDIT_HTTP_SPOOL_DIR "/workdir/privacera-audit-server/spool/session-http-spool" Local spool directory used to buffer events when HTTP delivery fails.
AUDITSERVER_SESSION_AUDIT_HTTP_URLS Auto-resolved from AUDIT_FLUENTD_INTERNAL_URL/session_audits when Fluentd is enabled; empty otherwise HTTP endpoint(s) where session audit events are posted.
SESSION_AUDITS_SOLR_DESTINATION "false" Set to "true" to forward session audit events from Ranger to the Audit Server, which routes them through Fluentd to S3. See Auditserver Destination below.

Note

The three sub-properties (IS_ENABLED, DESTINATION_HTTP, DESTINATION_HTTP_IS_ENABLED) automatically inherit the gate value. Setting AUDITSERVER_SESSION_AUDIT_ENABLE: "true" is sufficient when Fluentd is also enabled. When Fluentd is not enabled, AUDITSERVER_SESSION_AUDIT_HTTP_URLS resolves to empty and the template forces HTTP delivery to false to prevent a no-URL misconfiguration.

Auditserver Destination

Setting SESSION_AUDITS_SOLR_DESTINATION: "true" instructs Ranger to forward session audit events to the Audit Server. The Audit Server's Fluentd pipeline then routes those events to S3 (and any other configured cloud-storage backends).

To enable this, set the flag in custom-vars/vars.auditserver.yml:

YAML
1
SESSION_AUDITS_SOLR_DESTINATION: "true"

Alternatively, copy the ready-made sample file that contains all required properties pre-configured:

Bash
1
cp -n sample-vars/vars.session-audit.solr.yml custom-vars/

After saving, restart the services as described in Steps above.

ranger-privacera-site.xml — Ranger Admin Property

Property Value Description
ranger.audit.session.audit.enabled {{AUDITSERVER_SESSION_AUDIT_ENABLE}} Controls whether Ranger emits session audit events to the audit pipeline. This value is automatically set from AUDITSERVER_SESSION_AUDIT_ENABLE — no manual override is needed.

audit.properties — Rendered Session Audit Configuration

These properties are written to audit.properties only when AUDITSERVER_SESSION_AUDIT_ENABLE is "true":

Property Source Variable Description
session.xasecure.audit.is.enabled AUDITSERVER_SESSION_AUDIT_IS_ENABLED Master enabled flag for session audit.
session.xasecure.audit.destination.http AUDITSERVER_SESSION_AUDIT_DESTINATION_HTTP (forced false if URL is empty) Activates HTTP as a delivery destination.
session.xasecure.audit.destination.http.is.enabled AUDITSERVER_SESSION_AUDIT_DESTINATION_HTTP_IS_ENABLED (forced false if URL is empty) Secondary HTTP-enabled flag.
session.xasecure.audit.destination.http.batch.filespool.dir AUDITSERVER_SESSION_AUDIT_HTTP_SPOOL_DIR Spool directory for HTTP batch delivery.
session.xasecure.audit.destination.http.urls AUDITSERVER_SESSION_AUDIT_HTTP_URLS Target URL(s) for HTTP delivery.

Fluentd Routing

Session audit events posted to the /session_audits HTTP endpoint are routed by new <match session_audits> blocks in each Fluentd backend configuration. Events are stored under the path pattern audits/json/auditType=session_audits/year=%Y/month=%m/day=%d/ in all cloud-storage backends.

Backend Buffer Path
S3 /fluentd/log/s3/session_audits_*
GCS /fluentd/log/gcs/session_audits_*
Azure ADLS /fluentd/log/session-audits-azure-adls/session_audits_*
Azure Blob /fluentd/log/session-audits-azure-blob/session_audits_*
Local In-memory / file output (no explicit buffer path)

All cloud backends store events as gzip-compressed JSON. The Local backend uses raw JSON file output.