Member since
04-08-2019
115
Posts
97
Kudos Received
9
Solutions
My Accepted Solutions
Title | Views | Posted |
---|---|---|
4180 | 04-16-2016 03:39 AM | |
2248 | 04-14-2016 11:13 AM | |
3887 | 04-13-2016 12:31 PM | |
4891 | 04-08-2016 03:47 AM | |
3886 | 04-07-2016 05:05 PM |
04-14-2016
01:05 AM
1 Kudo
@Phil G , With kerberos enabled you need to enable SPNEGO authentication for kerberos. Could you follow the below link, http://docs.hortonworks.com/HDPDocuments/Ambari-2.2.1.1/bk_Ambari_Security_Guide/content/_configuring_http_authentication_for_HDFS_YARN_MapReduce2_HBase_Oozie_Falcon_and_Storm.html Hope this helps.
... View more
04-13-2016
12:31 PM
2 Kudos
@Mart van Loon You could try setting this cluster-env parameter "ignore_groupsusers_create" using configs.sh. cd /var/lib/ambari-server/resources/scripts ./configs.sh set $AMBARI-SERVER-FQDN $AMBARI-CLUSTER-NAME global ignore_groupsusers_create "true" Hope this helps.
... View more
04-12-2016
02:14 PM
4 Kudos
***Take the backup of complete RANGER database before you perform any operation. This can happen if you encounter any issues during the upgrade or required java patches are partially applied 1) Stop Ranger from ambari ui 2) Take fresh db dump 3) Login to the ranger database, review x_policy table and make sure all policies are available (If policies are missing, you may have to restore database from the backup taken before the upgrade and simply restart ranger service) mysql> use ranger;
mysql> select * from x_policy; 4) Delete all java patches from x_db_version_h table mysql> select * from x_db_version_h;
mysql> create table x_db_version_h_backup as select * from x_db_version_h;
mysql> delete from x_db_version_h where version like 'J%'; 5) Start ranger service from ambari ui This would take couple of minutes to re-apply all deleted patches. Once done, plugins will start downloading policies 6) Login to Ranger UI and verify whether policies are visible and plugins are in sync
... View more
Labels:
04-11-2016
01:56 PM
1 Kudo
"Error executing: call add_columns_to_support_audit_log_aggregation(); java.sql.SQLException: Incorrect key file for table 'xa_access_audit'; try to repair it SQLException : SQL state: HY000 java.sql.SQLException: Incorrect key file for table 'xa_access_audit'; try to repair it ErrorCode: 1034 2016-04-11 06:05:59,187 [E] 015-auditlogaggregation.sql import failed!" SOLUTION: Make sure you have enough space in the /tmp directory and take the backup of 'xa_access_audit' as below. Login to MySQL. use ranger_audit; create table xa_access_audit_backup as select * from 'xa_access_audit' ; truncate table xa_access_audit_backup; and retry the upgrade.
... View more
Labels:
04-11-2016
11:45 AM
2 Kudos
@Greenhorn Techie , There are only 2 options actually. 1). MIT KDC (commonly coupled with AD through a one-way trust) 2).Use of Corporate Active Directory. This is mainly driven by the customer requirement and their environemnt..If the customer has Active Directory and they want to integrate the Hadoop Cluster with the AD then you would go with Option 2 or 3. Having a Local MIT KDC fully dedicated to the Hadoop and setting up cross-realm trust with the corporate AD would be the easiest option as nd all the service principals are actually created in the local MIT KDC. Also this option is best-suited for an large cluster where so many ticket request to the AD are actually proxied by KDC itself. however as @Paul Codding mentioned, The real world problem is with the ownership of the local MIT KDC. Should it be owned by hadoop team or Kerberos Team ? You go down the first route because it puts the least burden on AD, but shifts that burden to the Hadoop Ops/Admin team to own. Option 2 puts all the burden on AD.
... View more
04-08-2016
03:47 AM
4 Kudos
@Madhavi Amirneni . You are trying to use AD as a simple LDAP. This works . Ranger without Kerberos is not of much use. The best practice for securing Hadoop cluster is to Kerberize the cluster first and then enable ranger. As an example, How you can bypass the Authorization without Authentication. usseradd baduser su - baduser whoami - confirm you are baduser, who has no special access or group memberships. hdfs dfs -ls /user/ You should get a directory listing hdfs dfs /user/ambari-qa hdfs dfs -ls /user/ambari-qa You should get denied as ambari-qa doesnt have world read permission. HADOOP_USER_NAME=hdfs ===> Now Impersonating as hdfs user. hdfs dfs -ls /user/ambari-qa you should get into the directory . Now you just hacked HDFS!!! You could potentiall do. hdfs dfs rm -r / and delete all the data!!!!!!! This why authorization without authentication is not of much help.! . This why you need KERBEROS. Hope this helps.
... View more
04-07-2016
05:05 PM
1 Kudo
@Arvind Kandaswamy On the Ambari Server, Could you try the below netstat -nap | grep 8080 ps -ef | grep ambari If there are some stray process running then kill them , Make sure no one is listening on 8080.
... View more
04-07-2016
02:56 PM
3 Kudos
Snakebite is a pure python based HDFS client which is much faster than the classic hdfs client operations(hadoop fs / hdfs dfs).Snakebite is developed by Spotify. More details can be found at https://github.com/spotify/snakebite I am using HDP 2.4 and Ambari 2.2.1.1 on CentOS/ 1). Install Python Pip. yum install python-pip 2).Install Snakebite. pip install snakebite Now snakebite is installed. You can run below sample commands. snakebite ls /tmp snakebite ls / Use snakebite help for more options. Happy Snakebiting!
... View more
Labels:
04-06-2016
03:09 PM
17 Kudos
This article gives an 8 step procedure to recover the accidentally deleted HDFS file which is not even available in the Trash. Use these procedure with caution on production system. I strongly suggest to take supports help if you are not familiar with the internal workings. IMPORTANT : Please make sure NameNode is stopped immediatly after file deletion otherwise it's hard to recover as namenode already send out block deletion request to datanode causing physical block might get deleted by datanode Always take backup of "fsimage" and "edits" file before you perform this step. 1).Lets create a sample file in HDFS su - hdfs hadoop fs -put /etc/passwd /tmp [hdfs@hdpnode1 current]$ hadoop fs -ls /tmp/passwd -rw-r--r-- 3 hdfs hdfs 2370 2016-04-06 12:45 /tmp/passwd 2).Delete the file and also make sure that the file doesnt go to trash. hadoop fs -rmr -skipTrash /tmp/passwd 3).Stop the HDFS service via Ambari. 4). Go to Namenode metadata directory(dfs.namenode.name.dir).In my lab environment it is set to /data/hadoop/hdfs/namenodecd /data/hadoop/hdfs/namenode cd current Look for a file with the name starting “edits_inprogress”. This should be most recent file where all the transactions are pushed to. 4). Convert the binary edits file to xml format.To convert the edits_inprogress file to XML,Use hdfs oev -i edits_inprogress_0000000000000001689 -o edits_inprogress_0000000000000001689.xml 5). Open the file and look for the transaction which recorded the delete operation of the file /tmp/passwdIn our case it looked like below. <RECORD> <OPCODE>OP_DELETE</OPCODE> <DATA> <TXID>1792</TXID> <LENGTH>0</LENGTH> <PATH>/tmp/passwd</PATH> <TIMESTAMP>1459943154392</TIMESTAMP> <RPC_CLIENTID>7aa59270-a89f-4113-98b5-6031ba898a8c</RPC_CLIENTID> <RPC_CALLID>1</RPC_CALLID> </DATA> </RECORD> Remove the complete entry (RECORD to RECORD) and save the XML file.6). Convert back the XML to binary format. Use , cd /data/hadoop/hdfs/namenode/current hdfs oev -i edits_inprogress_0000000000000001689.xml -o edits_inprogress_0000000000000001689 -p binary 7). If the interested transaction entry in the edits_inprogress is the last entry , then you could just start up the name node,which brings you back the lost /tmp/passwd file to the /tmp directory. If you see any further transaction post the accidental delete, then you need to run name node recovery command as below. hadoop namenode -recover 16/04/06 13:07:58 INFO namenode.NameNode: STARTUP_MSG: /************************************************************ STARTUP_MSG: Starting NameNode STARTUP_MSG: host = hdpnode1.world.com/192.168.56.42 STARTUP_MSG: args = [-recover] STARTUP_MSG: version = 2.7.1.2.4.0.0-169 STARTUP_MSG: classpath = / <OUTPUT TRUNCATED FOR BREVITY> TARTUP_MSG: build = git@github.com:hortonworks/hadoop.git -r 26104d8ac833884c8776473823007f176854f2eb; compiled by 'jenkins' on 2016-02-10T06:18Z STARTUP_MSG: java = 1.8.0_60 ************************************************************/ 16/04/06 13:07:58 INFO namenode.NameNode: registered UNIX signal handlers for [TERM, HUP, INT] 16/04/06 13:07:58 INFO namenode.NameNode: createNameNode [-recover] You have selected Metadata Recovery mode. This mode is intended to recover lost metadata on a corrupt filesystem. Metadata recovery mode often permanently deletes data from your HDFS filesystem. Please back up your edit log and fsimage before trying this!Are you ready to proceed? (Y/N) (Y or N) Y You would see error of something like the below one. 16/04/06 13:08:09 ERROR namenode.FSImage: Error replaying edit log at offset 2186. Expected transaction ID was 1798 Recent opcode offsets: 1825 1946 2081 2186 org.apache.hadoop.hdfs.server.namenode.RedundantEditLogInputStream$PrematureEOFException: got premature end-of-file at txid 1797; expected file to go up to 1798 at org.apache.hadoop.hdfs.server.namenode.NameNode.main(NameNode.java:1707) 16/04/06 13:08:09 ERROR namenode.MetaRecoveryContext: We failed to read txId 1798<OUTPUT TRUNCATED FOR BREVITY>org.apache.hadoop.hdfs.server.namenode.NameNode.main(NameNode.java:1707) 16/04/06 13:08:09 ERROR namenode.MetaRecoveryContext: We failed to read txId 1798 You now have following options, Enter 'c' to continue, skipping the bad section in the log Enter 's' to stop reading the edit log here, abandoning any later edits Enter 'q' to quit without savingEnter 'a' to always select the first choice in the future without prompting. (c/s/q/a)Enter 'c' to continue, skipping the bad section in the log Enter 's' to stop reading the edit log here, abandoning any later edits Enter 'q' to quit without saving Enter 'a' to always select the first choice in the future without prompting. (c/s/q/a)ENTER c 16/04/06 13:08:18 INFO namenode.MetaRecoveryContext: Continuing 16/04/06 13:08:18 INFO namenode.FSImage: Edits file /data/hadoop/hdfs/namenode/current/edits_0000000000000001777-0000000000000001798 of size 2186 edits # 21 loaded in 9 seconds 16/04/06 13:08:18 INFO namenode.FSNamesystem: Need to save fs image? false (staleImage=false, haEnabled=false, isRollingUpgrade=false) 16/04/06 13:08:18 INFO namenode.FSEditLog: Starting log segment at 1799 16/04/06 13:08:19 INFO namenode.NameCache: initialized with 0 entries 0 lookups 16/04/06 13:08:19 INFO namenode.FSNamesystem: Finished loading FSImage in 10125 msecs 16/04/06 13:08:19 INFO namenode.FSImage: Save namespace ... 16/04/06 13:08:19 INFO namenode.FSEditLog: Ending log segment 1799 16/04/06 13:08:19 INFO namenode.FSEditLog: Number of transactions: 2 Total time for transactions(ms): 1 Number of transactions batched in Syncs: 0 Number of syncs: 3 SyncTimes(ms): <OUTPUT TRUNCATED FOR BREVITY> /data/hadoop/hdfs/namenode/current/edits_0000000000000001801-0000000000000001802 16/04/06 13:08:19 INFO namenode.FSNamesystem: Stopping services started for standby state 16/04/06 13:08:19 INFO namenode.NameNode: SHUTDOWN_MSG: /************************************************************ SHUTDOWN_MSG: Shutting down NameNode at hdpnode1.world.com/192.168.56.42 ************************************************************/ The above recovery command does the the realignment of the HDFS transaction id in an orderly manner. 8).Now Restart the the HDFS via Ambari and check for the lost file using hadoop fs -ls /tmp/passwd
... View more
Labels: