Description of Problem: The hbck repair tool sometimes generates local indexes that are inconsistent with table data when overlapping regions are encountered.

Workaround: If you know the database schema, fix this issue by dropping and recreating all local indexes of the table after the hbck tool completes operation. Alternatively, rebuild the local indexes using the following ALTER query:

ALTER INDEX IF EXISTS index_name ON data_table_name REBUILD

Description of Problem: When Apache Knox uses Ambari as a proxy, the QuickLinks are not rewritten to go back through the gateway.

Workaround: If all access to Ambari is through Knox in the deployment the new Ambari quicklink profile may be used to hide and/or change URLs to go through Knox permanently. A future release will make these reflect the gateway appropriately.

Description of Problem: Since Spark 2.0.0, `DROP PARTITION BY RANGE` is not supported grammatically. In other words, only '=' is supported while `<', '>', '<=', '>=' aren't.

Associated Error Message:

scala> sql("alter table t drop partition (b<1) ").show
org.apache.spark.sql.catalyst.parser.ParseException:
mismatched input '<' expecting {')', ','}(line 1, pos 31)

== SQL ==
alter table t drop partition (b<1)
-------------------------------^^^ 

Workaround: To drop partition, use the exact match with '='. scala> sql("alter table t drop partition (b=0) ").show

Description of Problem: Column names are not getting created for Spark DataFrame

Workaround: There are two workaround options for this issue:

Description of Problem: The property spark.sql.hive.convertMetastoreOrc is set to "true" by default. This may impact performance.

Workaround: You can set this property as "false" to gain some performance improvement. However, you cannot use this property for ORC tables with new columns made by `ALTER TABLE`. The default is false for safety.

Description of Problem: A Hive query submitted to the %jdbc interpreter returns a proxy validation error.

Associated error messages:

Workaround:

Description of Problem: When used with Hive, the %jdbc interpreter might require Hadoop common jar files that need to be added manually.

Workaround:

Description of Problem: When Flume receives an event with null value in its header then File Channel will not accept it however the source will keep retrying to send it. Therefore that channel will stop working.

Error messages in log depending on the type of source:

'Error appending event to channel.' / 'Unable to put batch on required channel'
...
Caused by: java.lang.NullPointerException
at org.apache.flume.channel.file.proto.ProtosFactory$FlumeEventHeader$Builder.setValue(ProtosFactory.java:7415)

Workarounds:

Description of Problem: Rebuild(ALTER INDEX IDX ON TABLE REBUILD) of indexes created on the table having row_timestamp column will result in no data visible to the User for that Index.

Workaround: Drop the index and recreate the same index. There will not be any extra overhead of recreating index when compared with rebuild Index.

Description of Problem: Zeppelin does not show all WARN messages thrown by spark-shell. At the Zeppelin notebook level, we cannot change the log level that comes as an output.

Associated Error Message: There is no error message. This error is only related to increasing or decreasing logging in notebook output.

Workaround: Currently, there is no workaround for this.

Description of Problem: When upgrading from HDP-2.5.x to HDP-2.6.0 and using Spark2, the Livy interpreter is configured with a scope of 'global', and should be changed to 'scoped'.

Workaround: After upgrading from HDP 2.5 to HDP 2.6, set the interpreter mode for %livy (Spark 2) to "scoped" using the pulldown menu in the %livy section of the Interpreters page.

Component Affected: Zeppelin

Description of Problem: spark.driver.memory will not take effect, the driver memory is always 1G.

Workaround: To change the driver memory, specify it in the SPARK_DRIVER_MEMORY property on the interpreter setting page for your spark interpreter.

Description of Problem: Upgrading to a newer version of HDP version will not persist any Zeppelin notebooks from the previous version.

Workaround: Copy the Zeppelin notebooks from you previous HDP installation into /usr/hdp/current/zeppelin-server/notebook and restart zeppelin service. Zeppelin notebooks are located in /usr/hdp/<PREV_HDP_VERSION>/zeppelin/notebook

Description of Problem: Zeppelin fails to start during the upgrade process from HDP 2.5 to HDP 2.6. The error starts with

Exception in thread "main" org.apache.shiro.config.ConfigurationException: Unable to instantiate class org.apache.zeppelin.server.ActiveDirectoryGroupRealm for object named 'activeDirectoryRealm'. Please ensure you've specified the fully qualified class name correctly.

Workaround: This error is due to a change in configuration class for Active Directory.

In HDP 2.5:

org.apache.zeppelin.server.ActiveDirectoryGroupRealm

In HDP 2.6:

org.apache.zeppelin.realm.ActiveDirectoryGroupRealm

To resolve this issue, choose one of the following two alternatives:

Description of Problem: If config-default.xml is larger than 64k, it will produce an error.

Error Message: java.lang.RuntimeException: java.io.UTFDataFormatException: encoded string too long: 70771 bytes

Workaround: Currently, there is no known workaround.

Component Affected: Zeppelin/Livy

Description of Problem: This occurs when running applications through Zeppelin/Livy that requires 3rd-party libraries. These libraries are not installed on all nodes in the cluster but they are installed on their edge nodes. Running in yarn-client mode, this all works as the job is submitted and runs on the edge node where the libraries are installed. In yarn-cluster mode,this fails because the libraries are missing.

Workaround: Set the location inspark.jars in spark-defaults.conf. For Livy, you will need to set livy.spark.jars (the HDFS location) in livy interpreters conf. Both are globally applicable. The jars need to be present on the livy machine in both cases. Updating livy conf is preferable since it affects only the Zeppelin users.

Description of Problem: Executing concurrent queries over Spark via Spark1-llap package spawns multiple threads. This may cause multiple queries to fail. However, this will not break the spark thrift server. Spark 1.6 is built using Scala 2.10, which is where this issue manifests (i.e. " synchronize reflection code as scala 2.10 reflection is not threadsafe self"). This issue was subsequently fixed in Scala 2.11 based on this patch https://issues.scala-lang.org/browse/SI-6240.

Associated error messages:

Workaround: Isolate the broken queries and re-run them one by one. This will limit the query to one spawned thread.

Description of Problem: When Enable Group Search First is true and Enable User Search is true, users are not synced to Ranger where CN of the user is different from sAMAccountName.

Workaround: Currently, there is no known workaround.

Description of Problem: Canceling a Hive query from some third-party tools may not work (Squirel, Alteryx).

Workaround: Currently, there is no known workaround.

Description of Problem: Missing HTTP Headers and Cookie flags in Zeppelin

Workaround: If using or upgrading to HDP 2.6.2, you will need to add the following properties in the Zeppelin configuration in shiro.ini:

cookie = org.apache.shiro.web.servlet.SimpleCookie
cookie.name = JSESSIONID
cookie.secure = true
cookie.httpOnly = true
sessionManager.sessionIdCookie = $cookie

Description of Problem: When getting content summary is called (such as when du command is called) on a directory with a large number of subdirectories and files, other NameNode operations (for example, writes to the directory) may be slow. This is because get content summary will recursively check the permissions of all the sub-directories while holding an expensive lock.

Workaround: Currently, there is no known workaround.

Component Affected: Knox metrics collection

Description of Problem: Knox metrics collection was previously enabled by default. After extensive testing, test findings indicate that the level of detail provided at the URL level can adversely lead to an increase in memory footprint.

Workaround: Knox metrics collection is now disabled by default and you should only enable it with an understanding of the number of unique URLs that Knox metrics collection will access. This includes but is not limited to the number of unique files Knox can access via WebHDFS.

Description of Problem: Basic-search API ignores unknown attributes specified in entity or tag filters; and returns results after applying other valid filters.

Workaround: Currently, there is no known workaround. The API implementation will be updated in the next release to treat presence of unknown attributes as an error.

Description of Problem: Spark2, jdbc(spark), jdbc(spark2) and jdbc(hive_interactive) interpreters are not available on upgraded clusters from Ambari 2.4.2.0 and HDP 2.5.5.0.

Workaround: Delete interpreter.json (from /etc/zeppelin/conf) and restart Zeppelin Server from Ambari.

Description of Problem: After upgrading from Ambari 2.4.2 to Ambari 2.5.2 and subsequent HDP stack upgrade from 2.5 to 2.6, jdbc(hive) interpreter fails to work correctly in Zeppelin.

Error Message: You might see one of the following errors in the Zeppelin stacktrace after running jdbc(hive):

Workaround:

Description of Problem: HBase backup and restore related operations report failure after a 60 second timeout.

Error Message: You may see something similar to the following:

2017-05-31 20:28:24,527 ERROR [(zk1-e4a1b4.hdinsight.net,16000,1496260101005)-proc-coordinator-pool2-thread-1] procedure.Procedure: Procedure 'rolllog' execution failed!
org.apache.hadoop.hbase.errorhandling.TimeoutException via timer-java.util.Timer@7d071b9:org.apache.hadoop.hbase.errorhandling.TimeoutException: Timeout elapsed!
Source:Timeout caused Foreign Exception Start:1496262444394, End:1496262504394, diff:60000, max:60000 ms
        at org.apache.hadoop.hbase.errorhandling.ForeignExceptionDispatcher.rethrowException(ForeignExceptionDispatcher.java:83)
        at org.apache.hadoop.hbase.procedure.Procedure.waitForLatch(Procedure.java:397)
        at org.apache.hadoop.hbase.procedure.Procedure.call(Procedure.java:216)
        at org.apache.hadoop.hbase.procedure.Procedure.call(Procedure.java:68)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:748)
Caused by: org.apache.hadoop.hbase.errorhandling.TimeoutException: Timeout elapsed!
Source:Timeout caused Foreign Exception Start:1496262444394, End:1496262504394, diff:60000, max:60000 ms
        at org.apache.hadoop.hbase.errorhandling.TimeoutExceptionInjector$1.run(TimeoutExceptionInjector.java:66)
        at java.util.TimerThread.mainLoop(Timer.java:555)
        at java.util.TimerThread.run(Timer.java:505)

Workaround: Under normal circumstances, 60 seconds is a sufficient amount of time for this operation to succeed but results are not consistent. There is no workaround at the present time. HBASE-18646 tracks an improvement that will allow you to adjust the 60 second timeout value.

Description of Problem: When using basic search, the atlas logs are filled with INFO messages from the Titan layer. The log statements show the conversion of the entity/tag attribute names to the ones that are mapped under solr/elasticsearch (indexing backend), basically it shows the query transformation.

Workaround: To avoid excessive INFO level logs from index-search, you suppress the logs by setting the following property in Ambari for atlas configuration:

com.thinkaurelius.titan=WARN

Description of Problem: A newly introduced REPLADMIN permission appears in Hive permission list. However, this permission should not be included in policies. If added to policies, the service/public/api/policy API will return a 404 response.

Workaround: Remove REPLADMIN permission from affected policies.

Since Mahout is deprecated in favor of Spark ML, and every code change carries the risk of creating additional incompatibilities, we will document these difficulties rather than change these established behaviors in Mahout. These issues affect only Mahout.

Description of Problem: A new property has been added in HDP-2.6.2 to ensure that the Zeppelin JDBC Interpreter works correctly. However, this property is not added automatically when upgrading from lower versions to HDP-2.6.2. This can result in an Error in doAs when running the Zeppelin JDBC Interpreter for Hive in HDP-2.6.2.

Workaround: Perform the following steps to add the property manually:

Description of problem: Open JDK 8u242 is not supported as it causes Kerberos failure.

Workaround: Use a different version of Open JDK.

CVE-2018-11768: HDFS FSImage Corruption (potential DoS, file/dir takeover)

In very large clusters, the in-memory format to store the user, group, acl, and extended attributes may exceed the size of the on disk format, causing corruption of fsImage.

For more information on this issue, see the corresponding Knowledge article: TSB 2021-327:CVE-2018-11768: HDFS FSImage Corruption (potential DoS, file/dir takeover)

Impact of LDAP Channel Binding and LDAP signing changes in Microsoft Active Directory

Microsoft has introduced changes in LDAP Signing and LDAP Channel Binding to increase the security for communications between LDAP clients and Active Directory domain controllers. These optional changes will have an impact on how 3rd party products integrate with Active Directory using the LDAP protocol.

Workaround

Disable LDAP Signing and LDAP Channel Binding features in Microsoft Active Directory if they are enabled

For more information on this issue, see the corresponding Knowledge article: TSB-2021 405: Impact of LDAP Channel Binding and LDAP signing changes in Microsoft Active Directory

CVE-2020-9492 Hadoop filesystem bindings (ie: webhdfs) allows credential stealing

WebHDFS clients might send SPNEGO authorization header to remote URL without proper verification. A maliciously crafted request can trigger services to send server credentials to a webhdfs path (ie: webhdfs://…) for capturing the service principal

For more information on this issue, see the corresponding Knowledge article: TSB-2021 406: CVE-2020-9492 Hadoop filesystem bindings (ie: webhdfs) allows credential stealing

KMS Load Balancing Provider Fails to invalidate Cache on Key Delete

For more information on this issue, see the corresponding Knowledge article: TSB 2020-434: KMS Load Balancing Provider Fails to invalidate Cache on Key Delete

Corruption of HBase data stored with MOB feature

For more information on this issue, see the corresponding Knowledge article: TSB 2021-465: Corruption of HBase data stored with MOB feature on upgrade from CDH 5 and HDP 2

CVE-2021-27905: Apache Solr SSRF vulnerability with the Replication handler

The Apache Solr ReplicationHandler (normally registered at "/replication" under a Solr core) has a "masterUrl" (also "leaderUrl" alias) parameter. The “masterUrl” parameter is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To help prevent the CVE-2021-27905 SSRF vulnerability, Solr should check these parameters against a similar configuration used for the "shards" parameter.

For more information on this issue, see the corresponding Knowledge article: TSB 2021-497: CVE-2021-27905: Apache Solr SSRF vulnerability with the Replication handler

HBase MOB data loss

HBase tables with the MOB feature enabled may encounter problems which result in data loss.

For more information on this issue, see the corresponding Knowledge article: TSB 2021-512: HBase MOB data loss