insight

Describes the maprcli command to enable insights and get information related to insights.

Syntax

The insight command is used to manage the retrieval and pushing of audit log data by the insight service. The insight service retrieves and pushes audit log data related to MFS, CLDB, auth, and S3 services to Apache Iceberg tables. The data in the Apache Iceberg tables can be used for analysis related to anomalies in user behavior, such as authentication, authorization, file operations. Audit log data related to the individual services, MFS, CLDB, auth and S3, can be selectively pushed to Apache Iceberg tables.

Other operations related to insight data such as listing and specifying the retention period can be performed by using the insight command.

maprcli insight
cluster
	[ -enable set true/false ]
	[ -nodes node names space separated ]
	[ -type audit type [mfs, s3, auth, cldb] ]

info
	[ -nodes node names space separated ]
	[ -type audit type [mfs, s3, auth, cldb] ],
	[ -purge true/false ]
	
purge
	[ -retentionDays set retention days ]

See the individual subcommand help for details related to each subcommand.

TIP
Following are the parameters related to insights service that can be configured using the config save maprcli command.
  • cldb.insight.buffer.size
  • cldb.insight.commit.interval
  • cldb.insight.debug
  • cldb.insight.heartbeat.seconds
  • cldb.insight.purge.frequency
  • cldb.insight.threshold.heartbeats
  • cldb.insight.hms.host.fetch.seconds

    You can view the values for the insight-related parameters by using the config load maprcli command. For example:

    # maprcli config load -json | grep insight
               "cldb.insight.buffer.size":"1024",
               "cldb.insight.commit.interval":"5",
               "cldb.insight.debug":"0",
               "cldb.insight.heartbeat.seconds":"5",
               "cldb.insight.hms.host.fetch.seconds":"60",
               "cldb.insight.purge.frequency":"1",
               "cldb.insight.threshold.heartbeats":"5",
               "dfui.insight.enable":"0",