Mailing-List: contact dev-help@hbase.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@hbase.apache.org
Received-SPF: pass (athena.apache.org: domain of vanzin@cloudera.com
 designates 209.85.220.169 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CA+RK=_BwCpaxnOEDcFVOwc=QVayOFnsg+8RkxS-pxRFSdd6Gpw@mail.gmail.com>
References: 
 <CAAOnQ7sq7y2v6GfVEsrV4mjcQReUHWHZguuDoiqKnhDd1nwhSA@mail.gmail.com>
	<CA+RK=_C1tHyo30+vy52BShN-17YMcpa2rd46iB9+DHFNfiWbEQ@mail.gmail.com>
	<CAAOnQ7su9mB=qt3Fc2DJDiN8Uu_JcRtRu3FwJ6fAr0nsDNvmXQ@mail.gmail.com>
	<CA+RK=_BwCpaxnOEDcFVOwc=QVayOFnsg+8RkxS-pxRFSdd6Gpw@mail.gmail.com>
Date: Thu, 12 Jul 2012 16:42:00 -0700
Message-ID: 
 <CAAOnQ7vZu7KRWRGAGg7kTYj9NqYXyNxpm0LjhYdbN2kyoZVK2A@mail.gmail.com>
Subject: Re: Enhancing AccessController
From: Marcelo Vanzin <vanzin@cloudera.com>
To: dev@hbase.apache.org
Content-Type: text/plain; charset=UTF-8

Hello,

On Thu, Jul 12, 2012 at 3:54 PM, Andrew Purtell <apurtell@apache.org> wrote:
>> For example, HDFS logs audit messages at INFO level today (IIRC), while HBase does so at TRACE level.
> This has been fixed.

Ah, good to know. It seems our git mirrors are a little bit out of date.

>> Well, the logging path wouldn't go away; this would just be an
>> extension for people who have might complicated needs than just
>> writing to log files. We're looking at maybe providing a similar thing
>> for HDFS. In the end, we don't want the easy way to be any different
>> than it is today, but at the same time have a system where doing more
>> complicated things is possible.
>
> This is the right approach, IMHO, build it into Hadoop core and then
> we can use it in a manner consistent with how core does.

My concern with trying to come up with a common solution for core
Hadoop and HBase is that the data being logged is fundamentally
different. Sure, you could have a silly logger that just takes a
string, but that's no better than hacking through the logging system,
which can be done today.

A proper interface would have proper types provided to the logger
(e.g., the "AuthResult" class currently private in AccessController).
And those cannot be shared among different services; maybe some base
type with common audit-related fields, but not much more than that.

Anyway, I'll clean up my code and post it on Jira instead of
elongating this thread. :-)

-- 
Marcelo