Audit schema¶

Every access audit record is an instance of AuthzAuditEvent. The same object is serialized to JSON for HDFS files, log4j output, the Audit Server and Kafka, and mapped field by field into Solr, OpenSearch and Elasticsearch documents. This page lists the fields, their meaning and the names used in each store, so you can query the stores directly or parse the JSON files.

Empty fields are omitted from the JSON (@JsonInclude(NON_EMPTY)), so do not rely on every key being present.

Fields¶

Field names are the keys in JSON output. Solr, OpenSearch and Elasticsearch documents use the same names except where Store differences says otherwise. The example record shows typical values.

Who, what and where¶

Field	Type	Description
`id`	String	Unique event id, generated by the plugin.
`evtTime`	Timestamp	Time of the access.
`reqUser`	String	User who requested the access.
`repo`	String	Ranger service name, for example `dev_hive`.
`repoType`	Integer	Numeric service-type id from the service definition.
`resource`	String	Resource path, elements joined by `/`, for example `finance/tx/amount`.
`resType`	String	Name of the leaf resource element, for example `column`; the Hive plugin prefixes it with `@` (`@column`).
`access`	String	Access type checked, from the service definition, for example `select`.
`action`	String	Component operation that triggered the check, for example `QUERY`.
`reqData`	String	Request payload, for example the SQL statement.
`cliIP`	String	Client IP address.
`cliType`	String	Client type.
`sess`	String	Session id in the component.

Decision¶

Field	Type	Description
`result`	Integer	`1` allowed, `0` denied.
`policy`	Long	Id of the policy that decided the access; `-1` when none.
`policy_version`	Long	Version of that policy.
`enforcer`	String	Which enforcer decided: `ranger-acl`, `hadoop-acl`, and so on.
`reason`	String	Free-text reason, typically the resource that caused a denial.
`zone_name`	String	Security zone whose policy authorized the request.
`tags`	List of String	Tags attached to the resource (tag-based policies).
`datasets`	List of String	Governed Data Sharing datasets that granted access.
`datasetIds`	List of Long	Ids of those datasets.
`projects`	List of String	Governed Data Sharing projects that granted access.

Origin and bookkeeping¶

Field	Type	Description
`agent`	String	Plugin application type, for example `hiveServer2`.
`agentHost`	String	Host running the plugin.
`cluster_name`	String	Cluster name reported by the plugin.
`logType`	String	Record type, `RangerAudit`.
`seq_num`	Long	Sequence number within a session or process.
`event_count`	Long	Number of identical events merged by the summary queue; `1` when not summarized.
`event_dur_ms`	Long	Time span covered by a summarized event, in milliseconds.
`additional_info`	String (JSON)	Extra context: forwarded addresses, remote address, access-type list, request context.

JSON output formats evtTime as yyyy-MM-dd HH:mm:ss.SSS; Elasticsearch and OpenSearch documents use the ISO form yyyy-MM-dd'T'HH:mm:ss.SSS'Z' in UTC.

The audit field limits MAX_ACTION_FIELD_SIZE and MAX_REQUEST_DATA_FIELD_SIZE are 1800 characters.

For a Hive query the reqData field holds the SQL text; whether the Admin UI displays it is controlled by ranger.audit.hive.query.visibility in ranger-admin-site.xml.

Store differences¶

Three fields are renamed in Solr, OpenSearch and Elasticsearch documents:

JSON field	Store field
`policy_version`	`policyVersion`
`cluster_name`	`cluster`
`zone_name`	`zoneName`

additional_info and cliType are not written to these stores by the agents-audit destinations, and datasetIds is written to Solr only.

The Solr managed-schema and the Elasticsearch and OpenSearch mappings also declare fields that are not part of the event:

Field	Description
`_ttl_`, `_expire_at_`	Solr document expiry (`+90DAYS` by default), see Audit stores.
`_version_`	Solr internal version.
`text`, `tags_str`	Tokenized text fields declared for free-text search.
`reqContext`, `proxyUsers`	Declared in the schema; not written by the `agents-audit` destinations.
`req_caller_id`, `req_self_id`	Same.

Ranger Admin's Access Audits page queries these stores with the field names above (for example reqUser, repo, resource, result, evtTime ranges).

Example record¶

One line of a JSON audit file written by the HDFS destination, or one log4j message:

{
  "repoType": 3,
  "repo": "dev_hive",
  "reqUser": "gary.adams",
  "evtTime": "2026-09-15 06:11:45.123",
  "access": "select",
  "resource": "finance/tx/amount",
  "resType": "@column",
  "action": "QUERY",
  "result": 1,
  "agent": "hiveServer2",
  "policy": 42,
  "enforcer": "ranger-acl",
  "sess": "606b0764-7914-4f32-8343-04d8be6e5bd5",
  "cliType": "HIVESERVER2",
  "cliIP": "10.0.0.1",
  "reqData": "select amount from finance.tx",
  "agentHost": "hs2-1.example.com",
  "logType": "RangerAudit",
  "id": "85f0f6d7-2415-44e6-b277-6751d6c86ac7-3",
  "seq_num": 12,
  "event_count": 1,
  "event_dur_ms": 0,
  "cluster_name": "cl1",
  "policy_version": 7
}

Identity of an event¶

The summary queue merges events whose event key is identical within the summarization window. The key is built from reqUser, access, resource, resType, action, result, sess and cliIP; the merged record keeps the first event's fields and sets event_count and event_dur_ms. See Audit framework.