I totally agree with this. It's weird. It sounds like some kind of time bomb. I tried blocking the 8088 port but it didn't work for me (at least not for long). MYYARN jobs kept on piling up. It's over 20,000 jobs for the last couple of days. Any help from Hortonworks team would be appreciated. ... View more

Definitely an attack. I finally managed to spot a malicious IP address on my ResourceManager node that I could block. ... View more

No. I'm the only user connected. And while my cluster is not kerberized, my Ambari connection is made through HTTPS. ... View more

I have the same question (for the same reason, ie. not being kerberized yet). ... View more

Thanks but I did check beforehand and there was no crontab whatsoever running for any user on any machine in my cluster. ... View more

I did the change but it didn't change anything. Instead of being 'dr.who', it's now 'yarn' user that is feeding applications every 3 seconds that get stuck as "ACCEPTED". I still can't find how these applications are being triggered. Any other clue? ... View more

Mine are also staying in "ACCEPTED" status. And they're launched every 3 seconds... It's becoming a problem on the ResourceManager. When I look at the logs, I can only see actions coming from within my cluster. ... View more

I'm hitting exactly the same issue here with HDP 2.6. It looks like some kind of DOS attack but I have no clue on how to handle this? Any help from Hortonworks would be appreciated. ... View more