A data engineer complains that a job was not running as well as expected one afternoon and wants to find out what might have occurred.

To filter the audit details to these specifics, you need only the user name and the time frame. The example isolates actions by the user name cmjobuser for a one-hour period on November 3, 2016:

1. Limit the list of audit events to those for a specific user by defining a username filter:
   1. Click Filters to open the filter selector.
   2. Select Username from the Select Property... drop-down selector.
   3. Set the evaluation operator (=, like, !=) to = (equals sign).
   4. Type the username (cmjobuser for this example).
      
      
   5. Click Apply. The filter is applied to the audit events and the list displays only those events for the selected username.
2. Limit the Audit Events list for the selected username to only those events that occurred on a specific date at a specific time:
   1. Click the arrow next to the current date range field to open the date and time range options selector. Time frame options range from the last 2, 6, 12, or 24 hours to the last 7 or last 30 days, but also let you set a custom range.
      
      
      
      
   2. Click the Custom Range link to open the date and time range selector.
   3. Use the field controls to set the start date and time and the end date and time for your custom time frame, as shown in this example:
      
      
   4. Click Apply.

The date and time range is applied to the Audit Events filtered by username and displays the resulting list in reverse chronological order (end date and time at the top of the list). The Audit Events for username cmjobuser during the one-hour period from 3:00 to 4:00 PM on November 3, 2016 are shown below.

The results show both completed and attempted delete operations (attempted but unsuccessful are in red). All these events are associated with username navigator_user from the same IP address and using the same service (hdfs) over the course of a day (June 9, 2016).

The data files associated with a database are typically partitioned into files or directories by date, often by year. The system admin discovers that the data from 2015 is missing from the production database—only data prior to 2010 has been archived off the system, so data from 2015 should still be there.

Files for data created in 2015 include 2015 in their filenames.

The result of all filters and the selected time frame reveals that the hdfs username deleted directories containing 2015 in their names:

When a change occurs to a data asset, it can cause problems to reports or other processes that use the data asset. You can use the Audit events to find when and what caused a change in a data asset. This example describes how to use audits to determine what caused a schema change to a table so you can identify the user or process that may be causing unwanted changes.

To find all operations against a specific table in a general time range:

1. Filter the list of events for the table.
   1. Click Filters.
   2. Select Table Name from the Select Property... drop-down selector.
   3. Set the evaluation operator to like.
   4. Type the part or all of the table name in the entry field for the Table Name property.
   5. Click Apply. The source filter added to the list of filters and applied to Audit Events, returning an updated Audit Events list.
2. Set the date range to the general time frame where the change occurred:
   1. Click the date-time field at the top right of the Audit Events page.
   2. To set the range, click Custom Range. The Selected Range field is enabled for input.
   3. In the left date field, use the field controls to specify the earliest date where the change may have occurred.

      To include the entire day, set the time to indicate the beginning of the day, such as 12:01 AM.

   4. In the right date field, specify the latest date where the change may have occurred.

      To include the entire day, set the time to indicate the end of the day, such as 11:59 PM.

   5. Click Apply.
3. Review the results, looking at both the operation and the service name.
4. If the results are too large, consider adding additional filters:
   • By Service Name. For example, to show all Hive operations, use Service Name like hive.
   • By Operation. For example, to show only Hive operations that change the table metadata, use Operation like alter.