diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/ClientRMService.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/ClientRMService.java index 6f262dc5f12ad..aff4577c58628 100644 --- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/ClientRMService.java +++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/ClientRMService.java @@ -420,6 +420,8 @@ public GetApplicationReportResponse getApplicationReport( GetApplicationReportResponse response = recordFactory .newRecordInstance(GetApplicationReportResponse.class); response.setApplicationReport(report); + RMAuditLogger.logSuccess(callerUGI.getUserName(), + AuditConstants.GET_APP_REPORT, "ClientRMService", applicationId); return response; } @@ -449,7 +451,14 @@ public GetApplicationAttemptReportResponse getApplicationAttemptReport( ApplicationAttemptReport attemptReport = appAttempt .createApplicationAttemptReport(); response = GetApplicationAttemptReportResponse.newInstance(attemptReport); + RMAuditLogger.logSuccess(callerUGI.getUserName(), + AuditConstants.GET_APP_ATTEMPT_REPORT, "ClientRMService", + applicationId, appAttemptId); }else{ + RMAuditLogger.logFailure(callerUGI.getShortUserName(), + AuditConstants.GET_APP_ATTEMPT_REPORT, "User does not have privilege to " + + ApplicationAccessType.VIEW_APP.toString(), "ClientRMService", + AuditConstants.UNAUTHORIZED_USER, applicationId, appAttemptId); throw new YarnException("User " + callerUGI.getShortUserName() + " does not have privilege to see this attempt " + appAttemptId); } @@ -480,7 +489,13 @@ public GetApplicationAttemptsResponse getApplicationAttempts( .createApplicationAttemptReport()); } response = GetApplicationAttemptsResponse.newInstance(listAttempts); + RMAuditLogger.logSuccess(callerUGI.getUserName(), + AuditConstants.GET_APP_ATTEMPTS, "ClientRMService", appId); } else { + RMAuditLogger.logFailure(callerUGI.getShortUserName(), + AuditConstants.GET_APP_ATTEMPTS, "User does not have privilege to " + + ApplicationAccessType.VIEW_APP.toString(), "ClientRMService", + AuditConstants.UNAUTHORIZED_USER, appId); throw new YarnException("User " + callerUGI.getShortUserName() + " does not have privilege to see this application " + appId); } @@ -525,7 +540,13 @@ public GetContainerReportResponse getContainerReport( } response = GetContainerReportResponse.newInstance(rmContainer .createContainerReport()); + RMAuditLogger.logSuccess(callerUGI.getUserName(), + AuditConstants.GET_CONTAINER_REPORT, "ClientRMService", appId); } else { + RMAuditLogger.logFailure(callerUGI.getShortUserName(), + AuditConstants.GET_CONTAINER_REPORT, "User does not have privilege to " + + ApplicationAccessType.VIEW_APP.toString(), "ClientRMService", + AuditConstants.UNAUTHORIZED_USER, appId); throw new YarnException("User " + callerUGI.getShortUserName() + " does not have privilege to see this application " + appId); } @@ -568,7 +589,13 @@ public GetContainersResponse getContainers(GetContainersRequest request) listContainers.add(rmContainer.createContainerReport()); } response = GetContainersResponse.newInstance(listContainers); + RMAuditLogger.logSuccess(callerUGI.getUserName(), + AuditConstants.GET_CONTAINERS, "ClientRMService", appId); } else { + RMAuditLogger.logFailure(callerUGI.getShortUserName(), + AuditConstants.GET_CONTAINERS, "User doesn't have permissions to " + + ApplicationAccessType.VIEW_APP.toString(), "ClientRMService", + AuditConstants.UNAUTHORIZED_USER, appId); throw new YarnException("User " + callerUGI.getShortUserName() + " does not have privilege to see this application " + appId); } @@ -1475,7 +1502,7 @@ public ReservationListResponse listReservations( requestInfo.getReservationId()); } - checkReservationACLs(requestInfo.getQueue(), + String user = checkReservationACLs(requestInfo.getQueue(), AuditConstants.LIST_RESERVATION_REQUEST, reservationId); long startTime = Math.max(requestInfo.getStartTime(), 0); @@ -1492,6 +1519,8 @@ public ReservationListResponse listReservations( reservations, includeResourceAllocations); response.setReservationAllocationState(info); + RMAuditLogger.logSuccess(user, AuditConstants.LIST_RESERVATION_REQUEST, + "ClientRMService: " + reservationId); return response; }