@melek6199  When you setup an Apache NiFi cluster versus a standalone NiFi instance, the cluster coordinator and zookeeper become part of the setup.  Since a NiFi cluster is a zero master cluster, the UI can be access from any cluster connected node.  So your user authenticates to the specific node you are accessing and then that node proxies the user request (initially that would "access the flow") on behalf of that user to the cluster coordinator that replicates request to all connected nodes.    The exception means that node with node identity derived from certificate DN "CN=vtmrt3anifit04.x.com, OU=NIFI" was not properly authorized to "proxy user requests". All your NiFi node identities must be authorized to "proxy user requests". While it appears that your NiFi authorizers.xml is setup correctly with your 4 node's identities (case sensitivity also correct), I suspect it was only setup correctly after NiFi having already being started before it was configured correctly. The "file-access-policy-provider" will only generate the authorizations.xml during NiFi startup if it does NOT already exist.  It also will not modify an already existing authorizations.xml file. The "file-user-group-provider" will only generate the users.xml during NiFi startup if it does not already exist.  It also will NOT modify an already existing users.xml file. So I would inspect the users.xml to make sure it contains all 4 node identities (case sensitive correctly) and then verify the authorizations.xml has those node's properly authorized. So I would start here to make sure above is correct on all 4 nodes. Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped. Thank you, Matt ... View more

@shiva239  There are numerous things happening when a node is disconnected. A disconnected node is different then a dropped node.  A cluster node must be disconnected before it can be dropped.   A node can become disconnected in two ways: Manually disconnected - User manually disconnects a node via the NiFi Cluster UI.  A manually disconnected node will not attempt to auto-rejoin cluster. A user can manually reconnect the node from another node in the cluster via the same Cluster UI. A node becomes disconnected due to some issue.   A node that is disconnected is still part of the cluster until it is dropped.  Once dropped the cluster no longer considers it part of the cluster.  This distinction matter when it comes to load balanced connections that use a load balance strategy other then Round Robin. Load balance connections use NiFi Site-To-Site protocol to move FlowFiles between nodes.  Only Connected nodes are eligible to have FlowFiles sent over Site-To-Site. Even a disconnected node is still able to load-balance FlowFiles to other nodes still connected in the cluster.   (so when you had 1 node disconnect from cluster, if you went to that nodes UI directly the load balanced connection would appear to processing all FlowFiles normally.  This is because the two nodes where it sends some FlowFiles by attribute are still connected and thus it is allowed to send to them.  The other FlowFiles by attribute destined for disconnected node never leave the node and get processed locally.  Over on the still cluster connected nodes the story is different.  They can only send to connected nodes and any FlowFiles destined for that disconnected node will begin to queue.  Even if you stopped the dataflows on the disconnected node the FlowFiles would continue to queue for that node.  So stopping the dataflow on a node that disconnects would still present same issue. A disconnected node is still aware of what node are part of the cluster and can still communicate with ZK to know which node is the elected cluster coordinator.  Lets say a second node disconnects.  The disconnected node would stop attempting to send to that now disconnected node and queue FlowFiles destined for that node. Only the round robin strategy will attempt to redistribute FlowFile to remaining connected nodes when a node becomes disconnected.  The Partition by attribute and Single Node strategies are used when it is important that "like" FlowFiles end up on the same node for downstream processing (So once a like FlowFile, which in your case are FlowFiles with same value in the orderid FlowFile attribute, is marked for node 3, all FlowFiles with that same orderId will queue for node 3 as long as node three is still a member of the cluster.  A disconnected node is still part of the cluster and will have some "like" FlowFiles already on it, so we would not want NiFi to start sending "Like" data to some other node all of a sudden.  Now if manual user action was taken to drop the disconnected node, then the load-balanced connections would start using a different node for the FlowFiles original being allocated to the disconnected node.  NiFi also offers an off-loading feature. This allows a user with proper authorization to off-load a disconnected node (IMPORTANT: only a reachable and running node can be offloaded successfully. Attempting Offloading of a down or unreachable node will not work).  Once a node is disconnected a user can choose to offload the node this is typical if say a user want to decommission a node in the cluster.  Initiating off-load will send a request to that disconnected node to stop, terminate all running components and then off load the queued FlowFiles to other nodes connected to the cluster.   If cluster nodes where allowed to continue to load-balance to disconnected node(s), this capability would fail as you would end-up with a constant loop of FlowFiles back to disconnected node.  Once offloading completes that disconnected node could be dropped and the FlowFiles that were offload would get load balanced to remaining nodes still members of the cluster. I think I covered all the basic behind the scenes functionality of load-balanced connection with regards to disconnected node behaviors. In your scenario, your node, the node became disconnected due to some issue when changing the version of a version controlled process group.  I would recommend a new community question if you need help with that issue as it has no direct relationship with how load-balance connection function or disconnected nodes still running discussed here. Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped. Thank you, Matt ... View more

@Shrink   What do you mean by "by storing flow file temporally to save RAM or backpressure"? FlowFiles held in NiFi connections will consume NiFi heap memory (unless queue has gotten very large resulting some of those queued FlowFiles being swapped to disk).  But this behavior is no different if you use process groups or not. Process groups do allow you to configure: "Process Group FlowFile Concurrency" "Process Group Outbound Policy" I assume you are using the above to control the FlowFile going in and out of your process groups as those FlowFiles move from one process group to the next?  Using these allows you to insure processing in one PG completes before the outbound FlowFiles are released to the next downstream process group.  This also allows you to leave all your processor in a running state for more efficient /performant dataflow. Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped. Thank you, Matt ... View more

@Alf015  The  "merge-param-context" cli.sh NiFi command does the following when merging one parameter context into another: Adds any parameters that exist in the exported context that don't exist in the existing context.  So your observations align with the documented behavior of this command.  It will not modify value of any already existing parameter in the destination parameter context. It sounds like what you want to be using in the "set-param" command instead: Creates or updates a parameter in the given parameter context. Above will allow you to modify an existing parameter within the target parameter context. Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped. Thank you, Matt ... View more

@Alf015  The merge-param-context command will merge an exported parameter context's parameters into another existing parameter context. As simple exported parameter context with three parameters defined in it looks like this: { "name" : "test-param", "description" : "", "parameters" : [ { "parameter" : { "name" : "test1", "description" : "", "sensitive" : false, "value" : "test1", "provided" : false, "inherited" : false } }, { "parameter" : { "name" : "test2", "description" : "", "sensitive" : false, "value" : "test2", "provided" : false, "inherited" : false } }, { "parameter" : { "name" : "test3", "description" : "", "sensitive" : false, "value" : "test3", "provided" : false, "inherited" : false } } ], "inheritedParameterContexts" : [ ] } You can then use the merge-param-context command to merge the exported parameter context with another parameter context that already exists in the target NiFi: ./cli.sh nifi merge-param-context -i /tmp/test-param.json -p /opt/nifi-toolkit/conf/mytarget.properties -pcid b47a13ab-0195-1000-cc06-dc7779729310 --verbose "test-param.json" contains above shared json "mytarget.properties" contains the connection info for target NiFi. "b47a13ab-0195-1000-cc06-dc7779729310" is the id for the destination parameter context in which I am merging the input parameters There is a sample .properties file (../conf/cli.properties.example) in the toolkit conf directory. Contents of mine looks like this: baseUrl=https://nifihostname:8443 keystore=/opt/nifi/conf/keystore.p12 keystoreType=PKCS12 keystorePasswd=<password> keyPasswd=<password> truststore=/opt/nifi/conf/truststore.p12 truststoreType=PKCS12 truststorePasswd=<password> proxiedEntity=<nifiadmin> You can get the values for above from your nifi.properties file of the target/destination NiFi.  The proxiedEntity is my NiFi user identity that has permissions to edit the destination parameter context I am importing the new parameters into.  NOTE:  Your NiFi node must be authorized to /proxy user requests with Access Policies in destination NiFi.  If you choose not to use a proxiedEntity, your NiFi node will need to be directly authorized to edit the target parameter context. Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped. Thank you, Matt ... View more