About the key services mentioned in this post:
Apache Solr – an open-source enterprise search platform. Ranger is using it to store audit logs.
Ambari Infra – core shared service used by Ambari managed components. The database is Solr.
Using a database for Audit Access in Ranger is not an option anymore with HDP 2.5. What is being offered now is Solr and HDFS. It is recommended that Ranger audits are written to Solr and HDFS.
Solr takes care of the search queries from th Ranger Web interface, while HDFS is for more persistent storing of audits.
This was done on an HDP 2.5 cluster on AWS.
Installing Ambari Infra
Even though the HDP’s documentation says Solr should be installed before Ranger, I installed Ranger service first because of my previous Ranger experience when I used MySql for audit logs.
So installing Ambari Infra is really a clicking job. The only thing to check is where the service is going to be installed. I installed it on NameNode. Remember, it is easy to move services from on node to another.
Configuring Ranger with Solr
Click on Ranger and click on Configs -> Ranger Audit. From there Turn on Audit to Solr and SolrCloud.
You should now have enabled both Solr and HDFS for collecting audit logs.
If you now log in to Ranger, you should see audit logs.
If you plan to build an application in Solr, do not use the solr that is intended for Ambari Infra but install Solr.
Very useful documentation on this topic is available here.