@Amry  The "clear state" option only appears if ListSFTP is configured to use "tracking timestamps" and there is state available to be cleared.   Since you are using "tracking entities", entities are being tracked in a NiFi MapCacheServer.     If your MapCacheServer has been configured with a "persistence Directory", you'll need to stop the cache server, delete the contents of the persistence directory and then restart the cache server to clear the data. If your MapCacheServer has NOT been configured with a "persistence Directory", you'll need to stop the cache server and then restart the cache server to clear the data. Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped. Thank you, Matt ... View more

@asand3r  Here are my observations from  what you have shared: You appear to be having a load balancing issue.  The LB icon on the connection indicates it is trying to actively load balance FlowFiles in that connection.    If load balancing is complete the  icon will look like this:   .  The  shared queue counts show that 1 node has reached queue threshold which would prevent it from receiving any more FlowFiles which includes from other nodes.  So I assume that the ~4,600 FlowFiles on first 2 nodes are destined for that third node but can not be sent because of queue threshold.   Considering the observation above, i would focus you attention on the node with the queue threshold. Maybe disconnect it from cluster via the cluster UI and inspect the flow on that node directly.  Check the logs on that third node for any reported error or warn issues. Perhaps EvaluateJson processor only on node 3 is having issues?  Maybe connectivity between first two nodes and and third node is having issues. Node 3 can't distribute any FlowFiles to nodes 1 or 2.  And nodes 1 and  2 can't distribute to node 3.  Maybe some sync issue happened node 3 for some reason has processor stopped. This may explain the stop and start of canvas getting things moving again.  If you just disconnect node 3 (one with queue threshold exceeded) only and then reconnect it back to cluster, do FlowFiles start moving?  At reconnection, node 3 will compare its local flow with cluster flow.  If you remove the LB connection configuration, do FlowFiles get processed? I am curious why in this flow design you have setup a LB connection after the ConsumeKafka processor.  This processor creates a consumer group and should be configured according the number of partitions on the target topic to maximize throughput and preventing rebalancing. Let's say your topic has 15 partitions for example. Your consumeKafka processor would then be configured with 5 concurrent tasks.  3 nodes X 5 tasks = 15 consumers in the consumer group.  each consumer is assigned to a partition.   This spread the consumption across all your nodes removing the need for the load balanced connection configuration. You are using a rather old version of Apache NiFi (~4 years old).  I'd encourage you to upgrade to take advantage of many bug, improvements, and security fixes.   Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped. Thank you, Matt ... View more

@AlokKumar  Apache NiFi out-of-the-box configuration utilizes the Single-User-provider for user authentication and the Single-User-Authorizer for authorization.  When using the Single-user-authorizer provider, you can not manage authorizations for additional users.  So with this out-of-the-box setup you will not see either the Users or Policies options in NiFi since only the single user generated by NiFi an authenticate and that user has full access.  These providers were created so that NiFi would be secured (HTTPS) on startup and would be accessible with modern browsers that now all redirect any http request to https. Prior to Apache NiFi 1.14 these single-user providers did not exist.  The out-of-the-box setup of NiFi was unsecured.   Users were required to create their own certificates, setup an external mechanism for user authentication, and setup an authorizer that could manage authorization policies for multiple user identities.   CFM 2.0.4 referenced in the doc link you shared is based off Apache NiFi 1.11.4.  Also worth noting is that Cloudera Flow Management (CFM) has never used the single user providers.  CFM is designed to deploy/install  enterprise ready secured managed Apache NiFi clusters. So before i can help here, I need to understand more about your setup.  Which login provider and which authorizer are you using?  If you are utilizing the out-of-the-box single user providers, that is the first thing you will need to change.   Understand that Apache NiFi does not provide a multi-user login provider.  So for multi-user access you'll need to use an external provider or utilize unique clientAuth certificates for each if your users.  You can see what options for user authentication exist in the Apache NiFi Admin Guide under the User Authentication section. Lightweight Directory Access Protocol (LDAP)  is probably the most commonly used. Now these unique user will require unique authorizations (Multi-Tenant Authorization), which the responsibility falls on the NiFi authorizers.xml configuration file. The most common setup for Apache NiFi will use the StandardManagedAuthorizer. This authorizer would then be configured to reference the FileAccessPolicyProvider which will enable the Policies option in the NiFi UI global menu.  In order to set policies against multiple "user identities", this provider must be made aware of all the possible user identities and if you want to authorize by groups, will also need to know what users belong to what groups.  So the file-access-policy-provider will require being configured with a user group provider.  There are several options, but here are the most common: FileUserGroupProvider - This enables the "users" option in the global menu and allows you to define your user identities and group identities manually.  Reminder: This has nothing to do with authentication. LdapUserGroupProvider- This syncs users and groups from an external ldap Composite Implementations - providers that allows multiple user-group-providers to be used at same time.  It is common to configure the file-access-policy provider to use the composite-configurable-user-group-provider and then configure the composite-configurable-user-group-provider to obtain users and groups from both the file-user-group-provider and the ldap-user-group-provider.  Where the file-user-group-provider is used to manage the user identities derived from your individual NiFi cluster node identities (yes, even your individual nodes in a NiFi cluster require some authorizations). An example authorizers.xml setup utilizing the common setup i described above can be seen here in the NIFi admin guide: https://nifi.apache.org/docs/nifi-docs/html/administration-guide.html#composite-file-and-ldap-based-usersgroups Hope above helps you get your setup configured to manage multiple unique users.  -------------------- Once you have multi-user authentication and authorization setup, you'll need to authorize your users.  All users will access the same root Process Group (PG) which is the top level canvas.  It is then common for a unique child PG to be created  for each unique user or group.  You can not hide components on the canvas, this is done to prevent one user/group from building their dataflows on top of other user's dataflows.  However, if a user/group is not authorized on a PG, they will only see a dashed outlined PG box and no details.  Same goes for processor  and other components.  And if they try to view the configuration they will not be able to see that either: Keep in mind that processor components will inherit their permissions/authorizations from the parent Process Group.  So once you authorize a user or group to child single PG, they will be able to add processors, deeper child PGs, etc within that authorized child PG without needing to set explicit policies on every  sub-component. Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped. Thank you, Matt ... View more

@AlokKumar  Apache NiFi does not have a configuration option to allow Connection Queues to show more then the highest priority 100.  Assuming a normally running dataflow, the listing of a queue would become outdated the moment you listed it as those highest priority would most likely been processed on by the time the listing was produced/returned to UI.  You could view provenance history for the processor feeding that connection to get more details on all the FlowFiles passed to that downstream connection.  Provenance allows you to look at the current lineage of any FlowFile.   Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped. Thank you, Matt ... View more

@Krish98  When you secure NiFi (HTTPS enabled), in the TLS exchange NiFi will either REQUIRE (if no additional methods of authentication are configured) or WANT (when additional method of authentication are configured, like SAML) a clientAuth certificate.  This is necessary for NiFi clusters to work.  Even when one node communicates with another, the nodes to be authenticated (done via a mutual TLS exchange) and authorized (authorizing those clientAuth certificates to necessary NiFi policies).   When accessing the NiFi UI, a MutualTLS exchange happens with your browser (client).  If the browser does not respond with a clientAuth certificate, NiFi will attempt next configured auth method, it your case that would be SAML. MutualTLS with trusted ClientAuth certificates removes the need to obtain any tokens, renew tokens, and simplifies automation tasks with the rest-api whether interacting via NiFi built dataflows or via external interactions with the NiFi rest-api.    The ClientAuth certificate DN is what is used as the user identity (final user identity that needs to be authorized is derived from the DN post any Identity Mapping Properties manipulation).  Just like your SAML user identities, your clientAuth certificate derived user identity needs to be authorized to whichever NiFi policies are needed for the requested rest-api endpoint. Tailing the nifi-user.log while making your rest-api calls will show you the derived user identity and missing policy when request is not authorized. Please help our community grow. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped. Thank you, Matt ... View more