Does ambari keep track of which user logs in and starts/stops what service

[Di Li <di...@ca.ibm.com>]

Hello folks,

I am wondering if ambari keeps track of which user (admin, or any other 
user) logs in and the actions submitted (start/stop services, etc).  The 
reason is that I would like to know if I can use such info to audit which 
user logged in at what time and did what on the server.  It's probably 
far-stretched, but does ambari also keep track of hostname/ip of incoming 
rest api calls (like which host submitted what rest api call)?

I know ambari server keeps track of configuration changes (which user id 
changed what) in the ambari-config-changes.log file. 

Thank you.

Di Li
InfoSphere BigInsights
IBM Ottawa Lab Palladium Campus
Email: dili@ca.ibm.com
Phone: 613-270-4883, Tie-line:315-4883

Re: Does ambari keep track of which user logs in and starts/stops what service

[Robert Levas <rl...@hortonworks.com>]

Hey Di Li…

Currently Ambari does not have such a facility.  The current architecture of Ambari’s REST API makes this difficult as you need to interpret each API call to determine what the user is trying to do.  With the addition of role-based access control, we now have a single point where we can log authorization attempts (see org.apache.ambari.server.security.authorization.AuthorizationHelper#isAuthorized) in which logging needs to be added; however this is still at a really high level as the authorizations are on things like "Start/Stop/Restart Services" and “Manage Alerts” - see org.apache.ambari.server.security.authorization.RoleAuthorization for the complete list. 

Rob



On 12/17/15, 5:03 PM, "Di Li" <di...@ca.ibm.com> wrote:

>Hello folks,
>
>I am wondering if ambari keeps track of which user (admin, or any other 
>user) logs in and the actions submitted (start/stop services, etc).  The 
>reason is that I would like to know if I can use such info to audit which 
>user logged in at what time and did what on the server.  It's probably 
>far-stretched, but does ambari also keep track of hostname/ip of incoming 
>rest api calls (like which host submitted what rest api call)?
>
>I know ambari server keeps track of configuration changes (which user id 
>changed what) in the ambari-config-changes.log file. 
>
>Thank you.
>
>Di Li
>InfoSphere BigInsights
>IBM Ottawa Lab Palladium Campus
>Email: dili@ca.ibm.com
>Phone: 613-270-4883, Tie-line:315-4883
>