Is this problem reproducible? Or, just a one time thing? ... View more

For recoverLease using CLI, see https://community.hortonworks.com/questions/146012/force-closing-a-hdfs-file-still-open-because-uncor.html?childToView=146021#answer-146021 ... View more

Thanks a lot! Ming and I have tried it. It works well. ... View more

> Is there any maximum configurable value of ipc.maximum.data.length? Hadoop does not enforce a maximum. > Can we change this value above 128MB? Yes, you may change it to 192MB or 256MB to get around the current issue. ... View more

What is your version of Hadoop? Could you post the output from "hadoop -version"? ... View more

Yes, the audit log will serve the purpose. Note that, in some cases, it is not straightforward to search the log for deletion since a directory (or a file) may not be deleted directly -- it may be deleted as a part of the deletion of its parent/ancestor directory. So we should first search the full path in the log. If it is not found, search the parent directory path and so on. It will be more complicated if deletion and re-creation occurred repeatedly. For example 1) user A: create /foo 2) user A: create /foo/bar 3) user A: del /foo 4) user B: create /foo 5) user B: del /foo Who has deleted /foo/bar? It is easy to mistakenly take user B as the answer. B is the last user deleted foo but B is not the user deleted /foo/bar. In such case, we should first determine when the target directory/file is created and then search what happened of it starting from the creation time. You can imagine that it is even harder to find out the correct answer if the path or the parent/ancestor paths are moved/renamed. We need to pay extra attention if the rename operation is involved. ... View more