Support Questions
Find answers, ask questions, and share your expertise

how to repair ranger audit index

When I attempt to view my audit logs in Ranger access logs, I get an error message in the top right corner that says "Unable to connect to Audit store."

In the solr error log I see an error message that the index is corrupt:

[root@sandbox ~]# fgrep CorruptIndexException /var/log/ambari-infra-solr/solr.log | sort | uniq Caused by: org.apache.lucene.index.CorruptIndexException: codec mismatch: actual codec=Lucene50FieldInfos vs expected codec=Lucene50SegmentInfo (resource=BufferedChecksumIndexInput(MMapIndexInput(path="/opt/ambari_infra_solr/data/ranger_audits_shard1_replica1/data/index/_e0te.si"))) Suppressed: org.apache.lucene.index.CorruptIndexException: codec footer mismatch (file truncated?): actual footer=124937585 vs expected footer=-1071082520 (resource=BufferedChecksumIndexInput(MMapIndexInput(path="/opt/ambari_infra_solr/data/ranger_audits_shard1_replica1/data/index/_e0te.si")))

I tried using CheckIndex with the exorcise option to fix it, but even that can't get rid of the demons:

[root@sandbox /]# java -cp /usr/lib/ambari-infra-solr/server/solr-webapp/webapp/WEB-INF/lib/lucene-core-5.5.2.jar -ea:org.apache.lucene... org.apache.lucene.index.CheckIndex /opt/ambari_infra_solr/data/ranger_audits_shard1_replica1/data/index -verbose -exorcise Opening index @ /opt/ambari_infra_solr/data/ranger_audits_shard1_replica1/data/index ERROR: could not read any segments file in directory org.apache.lucene.index.CorruptIndexException: codec mismatch: actual codec=Lucene50FieldInfos vs expected codec=Lucene50SegmentInfo (resource=BufferedChecksumIndexInput(MMapIndexInput(path="/opt/ambari_infra_solr/data/ranger_audits_shard1_replica1/data/index/_e0te.si"))) at org.apache.lucene.codecs.CodecUtil.checkHeaderNoMagic(CodecUtil.java:208) at org.apache.lucene.codecs.CodecUtil.checkHeader(CodecUtil.java:198) at org.apache.lucene.codecs.CodecUtil.checkIndexHeader(CodecUtil.java:255) at org.apache.lucene.codecs.lucene50.Lucene50SegmentInfoFormat.read(Lucene50SegmentInfoFormat.java:86) at org.apache.lucene.index.SegmentInfos.readCommit(SegmentInfos.java:362) at org.apache.lucene.index.CheckIndex.checkIndex(CheckIndex.java:488) at org.apache.lucene.index.CheckIndex.doCheck(CheckIndex.java:2407) at org.apache.lucene.index.CheckIndex.doMain(CheckIndex.java:2309) at org.apache.lucene.index.CheckIndex.main(CheckIndex.java:2235) Suppressed: org.apache.lucene.index.CorruptIndexException: codec footer mismatch (file truncated?): actual footer=124937585 vs expected footer=-1071082520 (resource=BufferedChecksumIndexInput(MMapIndexInput(path="/opt/ambari_infra_solr/data/ranger_audits_shard1_replica1/data/index/_e0te.si"))) at org.apache.lucene.codecs.CodecUtil.validateFooter(CodecUtil.java:418) at org.apache.lucene.codecs.CodecUtil.checkFooter(CodecUtil.java:330) at org.apache.lucene.codecs.CodecUtil.checkFooter(CodecUtil.java:378) at org.apache.lucene.codecs.lucene50.Lucene50SegmentInfoFormat.read(Lucene50SegmentInfoFormat.java:117) ... 5 more

Are there any other ways to fix this? If not, how can I clean out the index?

2 REPLIES 2

Super Collaborator

Check out this Lucidworks support response. I think it answers your questions: https://support.lucidworks.com/hc/en-us/articles/202091128-How-to-deal-with-Index-Corruption

@james.jones I did see this article. The 5.5.2 version of lucent CheckIndex no longer supports the -fix option. The only one that seemed comparable was the -exorcise option. The output is in the question.