The username "dr.who" is the default identity of anyone connecting to HDFS or YARN via the web server (REST) APIs in an unsecured, non-kerberos cluster where a connecting user's identity cannot be authentically determined. If your cluster is exposed to the internet, and/or you are unable to recognize any of these jobs, I'd recommend shutting down the service immediately and investigating a possible external attack. I'd also strongly recommend following: https://blog.cloudera.com/blog/2017/01/how-to-secure-internet-exposed-apache-hadoop/ and securing your cluster in such a deployment. ... View more