HADOOP-19365. AAL support for auditing. #7723
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1 task
|
@steveloughran I am starting work for auditing support. This is how I think we should do it:
The span-ID here will actually be the ID for the We will also need to something similar for the referrer header: All of this feels a bit hacky, but I can't figure out a better way to do this. Can't think of a way to attach the S3 request in AAL to the span, so we going with this overwriting values approach. it does achieve the desired end result. Always find it a bit hard to navigate around this auditing code..let me know if you think there's a better way to do this. If you're ok with my current approach, i will work on finishing up this PR. |
|
💔 -1 overall
This message was automatically generated. |
| @@ -49,6 +50,7 @@ | |||
| import org.apache.hadoop.fs.store.LogExactlyOnce; | |||
| import org.apache.hadoop.fs.store.audit.HttpReferrerAuditHeader; | |||
| import org.apache.hadoop.security.UserGroupInformation; | |||
| import software.amazon.s3.analyticsaccelerator.request.RequestAttributes; | |||
There was a problem hiding this comment.
now forcing this to always be on the classpath...best off just to copy them into S3AInternalAuditConstants
There was a problem hiding this comment.
annoyingly, if you create a new Execution attribute the SDK throws and exception:
No duplicate ExecutionAttribute names allowed but both ExecutionAttributes 16f8b8be and 234dd4d6 have the same name: span. ExecutionAttributes should be referenced from a shared static constant to protect against erroneous or unexpected collisions.
So to get the attribute, you need to use the shared attribute, which is why i need to take the dependency here.
doesn't make any sense to me why on a GET the attribute needs to be shared, will reach out to the SDK team.. but not much else I can do right now.
| @@ -400,6 +403,18 @@ public SdkHttpRequest modifyHttpRequest(Context.ModifyHttpRequest context, | |||
| .appendHeader(HEADER_REFERRER, header) | |||
| .build(); | |||
| } | |||
|
|
|||
| String spanId = executionAttributes.getAttribute(RequestAttributes.SPAN_ID); | |||
There was a problem hiding this comment.
these would need to go above 393 and passsed into the referrer, as done with the range and delete key size; having the range from the request would be good too.
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of PR
Relevant AAL PR: awslabs/analytics-accelerator-s3#280
modifyHttpRequestexecutionInterceptor in the LoggingAuditor called, these are now available in theExecutionAttributesand can be used for logging.Example logs:
Pending release of new AAL version which attaches the execution attributes.
How was this patch tested?
Testing in progress.
For code changes:
LICENSE,LICENSE-binary,NOTICE-binaryfiles?