-
Notifications
You must be signed in to change notification settings - Fork 9.1k
HADOOP-18257. Analyze S3A Audit Logs #6901
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
HADOOP-18257. Analyze S3A Audit Logs #6901
Conversation
💔 -1 overall
This message was automatically generated. |
f3e1bd5
to
fe0322a
Compare
💔 -1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
7303563
to
fb2a10e
Compare
💔 -1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
Updated for the avro upgrade to compile, but doesn't deal with the new avro tightening which needs to be addressed in production. Change-Id: Iab54a5fc151f7c447b1b84fb14dc8afb2a7d5573 HADOOP-18257. S3AAuditLogMergerAndParser changes * dest is a path to the avro file to create containing all of the files parsed. * tests updated with changed API Change-Id: I810b165a4c6d2354bc91523594c7a24a4c031aee HADOOP-18257. audit log: ParsedAuditLogEntry Change-Id: Iba0d57357cc04aad571f9f0f4d69ee7f1dd11712 HADOOP-18257. audit log * moved avro source * WiP of a serializable/writable object for easy use in MR, spark Change-Id: I56bbff0ad2d71b64984f4cc59e1f2c83ea25597a HADOOP-18257. spotbugs Change-Id: Ia0ab414bcca8a898eca95fe9ddd89b5bfcef3028 HADOOP-18257 audit log parser * tool is invoked through hadoop s3guard command * which can now also be invoked as "hadoop s3a"! * tests are improved. * OperationDuration implements DurationTracker for bit more completeness TODO * split out the record parsing into a hadoop MR record read/write * so support large scale parsing * cli tool just glues that together either for small parallelised extraction or for aggregation to one file. * but a bulk job would work with a larger dataset Change-Id: I25e333592d1058b460b0bfda5313a20de13c2e35 HADOOP-18257 audit log parser Initial round of changes * only log at debug during parsing * cli to take <path to source> <path of output file> where the output is a filename not a dir. Change-Id: Ibdba37e42a36b1933979d2a1e7265d07069ea0bd HADOOP-18257. Merging and Parsing S3A audit logs into Avro format for analysis.
e012694
to
8cd6bec
Compare
💔 -1 overall
This message was automatically generated. |
hasn't adaped to the 11.4 upgrade as it was using avro ser/deser as part of the workflow, and that can't be done with the class restrictions. |
We're closing this stale PR because it has been open for 100 days with no activity. This isn't a judgement on the merit of the PR in any way. It's just a way of keeping the PR queue manageable. |
Description of PR
HADOOP-18257. Analyze S3A Audit Logs
This is #6000 rebased and squashed with a couple of changes on top.
TODO
or for aggregation to one file.
How was this patch tested?
new unit test cases.
For code changes:
LICENSE
,LICENSE-binary
,NOTICE-binary
files?