Reply
Contributor
Posts: 29
Registered: ‎04-08-2016

CDH 5.7.0 Impala error: AclException: The ACL operation has been rejected

These errors are filling the event log but does not seem to cause any issues, and all health is reported green.

 

  • WARN org.apache.hadoop.security.UserGroupInformation: PriviledgedActionException as:impala (auth:SIMPLE) cause:org.apache.hadoop.hdfs.protocol.AclException: The ACL operation has been rejected. Support for ACLs has been disabled by setting dfs.namenode.acls.enabled to false.
    org.apache.hadoop.ipc.Server: IPC Server handler 11 on 9000, call
  • org.apache.hadoop.hdfs.protocol.ClientProtocol.getAclStatus from 10.10.10.80:46973 Call#8 Retry#0: org.apache.hadoop.hdfs.protocol.AclException: The ACL operation has been rejected. Support for ACLs has been disabled by setting dfs.namenode.acls.enabled to false.

We would like to fix the root cause for this to reduce noise in the logs.

 

Thanks

Posts: 1,903
Kudos: 435
Solutions: 305
Registered: ‎07-31-2013

Re: CDH 5.7.0 Impala error: AclException: The ACL operation has been rejected

You can turn on the ACL support to get rid of these logs. Impala checks if any ACLs exist on files/dirs as part of its permission checks, but if the NameNode receives an ACL read request but finds that the feature has not been enabled it logs that message and returns an ACLException. Impala is designed to accept such a thing as response and continue onwards assuming no ACLs exist, but it still results in the log print.

If you turn the ACL config on via the property the logging indicates, it won't cause harm, cause the only operation Impala is doing is to check if an ACL exists (does not set any unless you intend it to via Sentry HDFS ACL sync or manually).