白眉大叔 hdfs 目录被删除排查
一、问题发现
XXX 告知 XXX 集群目录被删除排查，并提供了被删除目录，请求定位被谁删除
问题排查
HDFS 审计日志查看
可以查看hdfs的namenode审计日志，在namenode所在节点查看/var/log/Bigdata/audit/hdfs/nn/hdfs-audit-namenode.log如下：可以找到哪个接口机删除的。
2019-06-29 00:32:44，275 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/013
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/013perm=hdfs:ss_deploy:rwxrwxrwxproto=rpc
2019-06-29 00:40:55，525 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/011
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/011perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
2019-06-29 00:41:20，228 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/017
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/017perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
2019-06-29 00:54:54，697 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/031
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/031perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
2019-06-29 01:03:05，264 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/018
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/018perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
2019-06-29 01:08:24，077 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/034
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/034perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
2019-06-29 01:10:29，977 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/038
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/038perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
2019-06-29 01:13:28，904 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/036
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/036perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
2019-06-29 01:31:42，517 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/051
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/051perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
2019-06-29 01:34:22，650 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/075
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/075perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
2019-06-29 01:36:09，417 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/071
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/071perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
2019-06-29 01:40:21，424 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/076
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/076perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
2019-06-29 01:51:24，962 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/079
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/079perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
2019-06-29 01:51:58，956 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/083
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/083perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
2019-06-29 02:00:20，934 INFO FSNamesystem.audit: allowed=true
ugi=hdfs (auth:SIMPLE)ip=/10.191.xxx.xxx cmd=rename options=2
src=/serv/smartsteps/raw/events/locationevent/2019/06/28/081
dst=/user/hdfs/.Trash/Current/serv/smartsteps/raw/events/locationev
ent/2019/06/28/081perm=hdfs:ss_deploy:rwxr-xr-xproto=rpc
欢迎来撩 ： 汇总all
