Log Server/Ambari - Missing Logs in Ambari and "No Data Available" in Log Search

[#1]

Hello. I have a HDF 2.1.2.0 installed with both Infra and Log Search configured. I am missing data both in Log Search and also in Ambari when I try to view logs for services on a host. This seems to have appeared after configuring the cluster for SSL and LDAP is configured for both Ambari and Log Search. Other clusters I have setup in the past few days data is shown on these screens below. The errors included below are coming from the Service Logs screen in Log Search. This screen appears to return current data.

I see this error roughly every 6 minutes in the Ambari Server Log -

2017-06-22 13:22:15,000 ERROR ambari-client-thread-3773 LoggingSearchPropertyProvider - Error occurred while making request to LogSearch service, unable to populate logging properties on this resource

This error appears in the logsearch_app every time I sign in to Log Search. I am able to connect successfully though using my AD account

2017-06-22 13:24:50,286 ERROR qtp1545087375-14 org.apache.ambari.logsearch.web.security.LogsearchFileAuthenticationProvider LogsearchFileAuthenticationProvider.java:81 - Wrong password for user=<MyAccount>

I do not see any errors in the logsearch_feeder logs.

Log Search

Ambari - Hosts - Logs screen

[#2 · Accepted solution]

Hi @Kirk DeMumbrane,

Can you post what version of Ambari you're using?

In the LogSearch Technical Preview, which was introduced in Ambari 2.4, there was a bug that would keep the Ambari integration layer (which displays the tail log of components in Ambari itself) from working properly when SSL was enabled.

This issue was resolved in Ambari 2.5:

https://issues.apache.org/jira/browse/AMBARI-19104

If you are working with Ambari 2.5, then you can probably just update the "logsearch_ui_protocol" in the "logsearch-env" configuration type to be "https", restart ambari-server, and the connection between ambari-server and the LogSearch Portal should work properly at that point, and I would expect that the error logs in ambari-server.log would stop occurring.

Regarding the "No Data Available" message, it is possible that the existing logging data in your cluster has expired, and been removed from the Solr data store. Typically, Solr expires logging data from LogSearch after 7 days, unless this has been explicitly configured.

Hope this helps!

Bob

[#3]

Hello Bob,

Thanks for your reply. The ambari version which is installed is 2.4.2.0. The bug explains the issue I am having.

I will check out your suggestion on the Solr data store.

Thanks

Kirk

[#4]

Hi @Kirk DeMumbrane,

Glad this information was useful.

If this resolves your problem, can you please accept this answer?

Thanks,

Bob