Ranger audit logs are disabled by default; you can enable the audit feature for the relevant components by modifying the configuration file as needed.
Note:
When you install Ranger in EMR-2.7.0 and later versions, a stand-alone Solr is installed by default on a single Master node to store Ranger’s audit logs, with a retention period of 7 days.
1. To enable the audit feature, taking HDFS as an example, go to the EMR Console> Cluster Services > HDFS > Configuration Management, and modify the ranger-hdfs-audit.xml file as follows:
xasecure.audit.is.enabled=true
xasecure.audit.solr.is.enabled=true
2. In Cluster Services > HDFS > Role Management, restart the NameNode role.