Ranger Audit Admin Page Not Found(404) Error

[#1]

Hi, in HDP 2.6.3, multinode, not kerberized env. I get following page not found error

[#2]

Hi @Erkan ŞİRİN

Are you using MySQL for the ranger DB backend? If so, there is a relevant jira describing this scenario and error, along with a potential solution; https://issues.apache.org/jira/browse/RANGER-1378

[#3]

Hi @Jonathan Sneep Yes, I use mysql for ranger database. let me look at JIRA if i can understand the solution 🙂

[#4]

Hi again @Jonathan Sneep unfortunately it didn't work. I changed the my.cnf, restarted mysql service furthermore i restarted all ranger services still can't display page.

mysql> show variables like 'SQL_MODE';
+---------------+------------------------------------------------------------------------------------------------------------------------+
| Variable_name | Value                                                                                                                  |
+---------------+------------------------------------------------------------------------------------------------------------------------+
| sql_mode      | STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION |
+---------------+------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

[#5]

Hey @Erkan ŞİRİN
I was hoping that would've solved it for you! I noticed your mention of a permission denied error on the .rangeradmin.jceks.crc file ; does the ranger user have access to that file or is that file currently set to root/root permissions? If currently on root/root permissions, have you tried chowning it to the ranger user / hadoop group and checking if that improves things?

[#6]

@Jonathan Sneep

ls -l /etc/ranger/admin/.rangeradmin.jceks.crc
-rw-r----- 1 root root 24 Jul 16 14:28 /etc/ranger/admin/.rangeradmin.jceks.crc

Many ranger user rangeradmin, ranger_solr, admin etc. which one should own it?

[#7]

@Erkan ŞİRİN
You can try it with the ranger / hadoop permissions, though I'm thinking that this error is possibly not the cause for the 404 on the admin page.
Can we also verify the global mysql variables?

mysql> show global variables like 'sql_mode'

[#8]

Hi @Jonathan Sneep I have changed the ownership to ranger:hadoop and restarted Ranger services bu it is no use. I have also checked sql modes. They are exactly same as above.

[#9]

@Erkan ŞİRİN
Ok... to make sure we covered all items mentioned within the apache jira, is the vx_trx_log table now present in mysql? We would need to recreate that table if it's not there now.

[#10]

@Jonathan Sneep There is

mysql> show tables;
+--------------------------------+
| Tables_in_ranger               |
+--------------------------------+
| vx_trx_log                     |
| x_access_type_def              |
| x_access_type_def_grants       |

[#11]

Follow below steps to fix the issue. 

Temp Solution:

login to mysql of ranger using root or ranger credentials. 

mysql -u root -p XXXXX

use ranger;

select * from vx_trx_log limit 1; u will get error message like "ERROR 1055 (42000): Expression #1 of SELECT list "

execute below command to set global variables to refresh the admin page. 

SET GLOBAL SQL_MODE = 'STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION';

wait for few mins and refresh the page.

Permanent solution. 

Open MySQL config file(my.cnf) file and change/add sql_mode as given below under [mysqld] section of the file

sql_mode=STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION

Restart MySQL server after shaving changes.

. 

[#12]

@Erkan ŞİRİN

Does the ranger host FQDN map to the ranger URL?

Can you share your Ranger Admin log file, xa_portal.log

[#13]

Hi @Geoffrey Shelton Okot It is attached.xa-portallog.txt

I think the problem is caused by this:

java.io.FileNotFoundException: /etc/ranger/admin/.rangeradmin.jceks.crc (Permission denied)