Member since
07-30-2019
3429
Posts
1632
Kudos Received
1012
Solutions
My Accepted Solutions
| Title | Views | Posted |
|---|---|---|
| 100 | 01-27-2026 12:46 PM | |
| 506 | 01-13-2026 11:14 AM | |
| 1107 | 01-09-2026 06:58 AM | |
| 944 | 12-17-2025 05:55 AM | |
| 449 | 12-17-2025 05:34 AM |
05-03-2018
04:25 PM
@Veerendra Nath Jasthi The "Owner" DN typically has a CN that matches the hostname of the server on which the certificate is being used. In this case it looks like you create a "nifiadmin" certificate on each node. If your CN in the "owner" DN does not match your servers hostname, you will need to have a SubjectAlternativeName (SAN) in your certificate that does. - Bottom line you will likely need new certificates here. - Then make sure that each of those server DNs match what you provided as DNs for the "Node Identity 1=, Node Identity 2=, Node Identity 3=". - Also, do not forget to delete the users.xml and authorizations.xml files so they get re-created with correct entries. - Thanks, Matt
... View more
05-03-2018
03:02 PM
@Veerendra Nath Jasthi *** Forum tip: Try to avoid responding to an existing "answer" by starting a new answer. It makes following the conversation very hard. Instead use "Add comment" on the existing answer. - When running the keytool command, juts try hitting enter when prompted for password without entering anything. - Did you use the include NIFi CA to create your keystore and truststore? Did you use the NiFi TLS-toolkit to generate your user certificate? - Thanks, Matt
... View more
05-03-2018
02:56 PM
@Naeem Ullah Khan I am not sure that i am completely clear on what you are trying to do... - "run this process as a cron job on a linux machine independent of NiFi" - Are you asking how to run these processors outside of a NiFi installation? If so, that is not possible. The NiFi core (Controller) handles the scheduling and management of the resources (CPU, heap, repositories, etc...) NiFi flows can not be exported to independent running processes. - You can install NiFi on your linux server(s) and even configure the run schedule as a cron. You can also create a template of yoru flow on one NiFi, download it, and then import it in to another NiFi installation. - Thanks, Matt - If you found this answer addressed your question, please take a moment to login to the forum and click "accept" on the answer.
... View more
05-03-2018
02:41 PM
@vincent yernaux There is no user configuration that needs to be done to get NiFi to create the nifi.pid file. Do you see any errors in the nifi-bootstrap.log about being unable to create the nifi.pid file? - I would suggest shutting down all 6 nodes. Then verify that the NiFi process is in fact stopped on all nodes. (ps -ef|grep nifi) Then restart your NiFi cluster again and monitor both the nifi-bootstrap.log and nifi-app.log for any errors/warns that may be related to pid file generation. - Thanks, Matt
... View more
05-03-2018
02:19 PM
2 Kudos
@Veerendra Nath Jasthi Where did you get the keystore files you are using on each of your nodes from? I suggest performing a verbose listing on your keystore ( keytool -v -list -keysrtore <keystore,jks file> ) That listing should show a single "PrivateKeyEntry" and that should then show a "Owner" and "Issuer" as below exmaple does: Alias name: nifi-key
Creation date: Apr 19, 2018
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=nifi-sme-15.openstacklocal, OU=NIFI
Issuer: CN=nifi-sme-26.openstacklocal, OU=NIFI
Serial number: 162df02fcaf00000000
Valid from: Thu Apr 19 17:45:37 UTC 2018 until: Sun Apr 18 17:45:37 UTC 2021
Certificate fingerprints:
MD5: B2:B3:A8:D0:DC:E4:98:1F:53:30:A6:B4:E0:79:41:1A
SHA1: 04:D9:3A:84:7B:75:AE:90:DD:C9:41:D3:83:1C:4F:BB:3C:18:EC:FA
SHA256: AD:69:23:80:A1:06:1A:6C:32:A4:4C:95:B5:0E:5F:0E:AA:12:BE:DF:05:84:B8:53:27:F3:D9:46:DD:89:03:7A
Signature algorithm name: SHA256withRSA
Version: 3
Extensions:
#1: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: A0 9D B4 20 80 B3 6D 31 70 2E 73 B0 7E E0 17 F9 ... ..m1p.s.....
0010: 3D 31 A1 B4 =1..
]
]
#2: ObjectId: 2.5.29.19 Criticality=false
BasicConstraints:[
CA:false
PathLen: undefined
]
#3: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
clientAuth
serverAuth
]
#4: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
DigitalSignature
Non_repudiation
Key_Encipherment
Data_Encipherment
Key_Agreement
]
#5: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
DNSName: nifi-sme-15.openstacklocal
DNSName: nifi-sme-15.openstacklocal
]
#6: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 9B 43 A1 B1 3D 9B AF B4 1B 1B 8F DA 31 D2 14 88 .C..=.......1...
0010: 4E 3E 93 A9 N>..
]
] - The "Owner" DN form each of your Nodes keystores should match the node identities you entered in your configs (case sensitive). - Also note that you have names every one of your entries as "Node Identity 1". You should instead have a unique number for each node identity. - My guess here is that maybe your keystore contains more then one "PrivateKeyEntry". Did you create a user certificate "CN=nifiadmin, OU=NIFIrsdevhdf2.medassurant.local, OU=NIFI" and import in to each of your nodes keystores? NiFi has no way to be configured to select a specific "PrivateKeyEntry" when multiple exist in same keystore. - The keystore should contain only 1 "PrivateKeyEntry". It may contain many "trustedCertEntry" entries. - Commonly your keystore.jks will contain only the single PrivateKeyEntry and your truststore.jks will contain 1 to many "TrustedCertEntry". - Once you have made the necessary corrections to your keystore.jks file and/or node identity configurations, you will need to delete the users.xml and authorizations.xml files that NiFi created as they are only created once. If they already exist, they will not be updated by changes you make to node identity configurations or initial admin identities. Once you can successfully access the secured NIFi UI as your initial admin, you will add the rest of your users and se their policies directly from within the UI. - Thanks, Matt - If you found this answer addressed your question, please take a moment to login to the forum and click "accept" on the answer.
... View more
04-30-2018
06:15 PM
@Olivier
Drouin @Xavier
COUDRE
Did you get your Site-To-Site working, If you found the answer below helpful, please take a moment to login and click "accept" below the answer.
... View more
04-27-2018
12:38 PM
@Gillu
Varghese
Keep in mind how JVM heap space works. At a very high level, objects in heap are not cleared out when no longer used. So a FlowFile's attributes while queued will exist in heap, when that FlowFile's no longer exists in flow (reached end of flow for example) that heap space is likely to still be occupied. It is the job of Java Garbage Collection (GC) to free unused heap space. So once heap utilization is high enough that free space is needed by the JVM, GC will run to create that free space. - So even after running a heavy flow and no FlowFiles are left anywhere in your dataflows, you may still observe high reported heap usage. That is normal and expected. - Thanks, Matt - If you found this answer addressed your original question, please take a moment to login and click "accept".
... View more
04-27-2018
11:50 AM
@Gillu
Varghese
The imbedded ZK was implemented to make setting up new NiFi Clusters quick and easy for POC and development type activities. The errors you are seeing are expected and not much can be done about that. It is recommended that an external ZK is used by NiFi instead of the internal. Especially fro a production type environment. Thank you, Matt
... View more
04-26-2018
03:00 PM
3 Kudos
@Rahul Soni @Gillu Varghese The GenerateFlowFile processor will create 1 GB of content for each FlowFile it creates. The FlowFile content does not live in heap memory space. - Each generated FlowFile will have a core set of FlowFile Attributes created. For example: -------------------------------------------------- Standard FlowFile Attributes
Key: 'entryDate'
Value: 'Thu Apr 26 14:52:12 UTC 2018'
Key: 'lineageStartDate'
Value: 'Thu Apr 26 14:52:12 UTC 2018'
Key: 'fileSize'
Value: '67'
FlowFile Attribute Map Content
Key: 'filename'
Value: '7409235136254821'
Key: 'path'
Value: './'
Key: 'uuid'
Value: '119b16a1-7cb2-40ff-b92e-77bc733389e6'
-------------------------------------------------- - You can however define attributes on attributes on each generated FlowFile by adding attributes via custom properties in GenerateFlowFile processor: FileSize in the case of heap does not matter when it comes to heap usage of queued FlowFiles. In this way you can create FlowFiles with as many attributes as you want: --------------------------------------------------
Standard FlowFile Attributes
Key: 'entryDate'
Value: 'Thu Apr 26 14:55:54 UTC 2018'
Key: 'lineageStartDate'
Value: 'Thu Apr 26 14:55:54 UTC 2018'
Key: 'fileSize'
Value: '0'
FlowFile Attribute Map Content
Key: 'attr1'
Value: 'This is a test'
Key: 'attr2'
Value: 'This is a test'
Key: 'attr3'
Value: 'This is a test'
Key: 'attr4'
Value: 'This is a test'
Key: 'filename'
Value: '7409457340083769'
Key: 'path'
Value: './'
Key: 'uuid'
Value: 'f6254149-be47-46f3-a659-c5126ae80481'
-------------------------------------------------- - You can adjust the run schedule and batch setting to control the number of new FlowFiles generated over a specific time period. - For example: Setting run Schedule to 5 sec and Batch Size to 1000, Every 5 seconds this procesor will produce 1000 new FlowFiles. - Thanks, Matt
... View more
04-26-2018
12:43 PM
@Xavier
COUDRE
Couple things here.... 1. None of the components in NiFi (processors, remote process groups, ports, etc...) are running as the user who is authenticated in to the NiFi UI. So authorizing users on input/output ports will have no affect here. 2. The source NiFi/MiNIFi must be configured with SSL certificates. NiFi's Site-To-Site protocol uses SSL to authenticate between NiFi instances. 3. Your screenshot below shows you authorizing what appears to be a user and not the source NiFi instance(s) to a Input port on the root canvas level. But did you also authorize the source NiFi instance(s) for the "GLOBAL" "retrieve site-to-site details" policy: As you can see by the above, I authorized my 3 NiFi instances in my cluster to retrieve site-to-site details. - And then on my input port itself, I authorized my 3 NiFi instances access to the input port: - Hope this helps, Matt
... View more