Apache Ranger by design provides configurable audits destinations. One of destinations is slf4j logging interface, which means audits can be streamed into any logging framework that is bound to slf4j. With this feature, Ranger can support streaming audits into popular messaging bus e.g. Kafka to provide realtime data feeds for various monitoring system.
Enabling audits logging is as simple as adding some configurations in logging properties files which the underlying hadoop product supports. Here is an example of configuring Hive logging properties file to enable sending audit events to Kafka messaging bus.
# # kafka Appender # log4j.logger.com.xasecure.audit.provider.Log4jAuditProvider=INFO,KAFKA_HIVE_AUDIT log4j.appender.KAFKA_HIVE_AUDIT=kafka.producer.KafkaLog4jAppender log4j.appender.KAFKA_HIVE_AUDIT.BrokerList=sandbox.hortonworks.com:6667 log4j.appender.KAFKA_HIVE_AUDIT.Topic=hive_audit_log log4j.appender.KAFKA_HIVE_AUDIT.layout=org.apache.log4j.PatternLayout log4j.appender.KAFKA_HIVE_AUDIT.layout.ConversionPattern=%d{ISO8601} %-5p [%t]: %c{2} (%F:%M(%L)) - %m%n log4j.appender.KAFKA_HIVE_AUDIT.ProducerType=async