Cloudera Docs

Known Issues

This section lists known issues and workarounds in Cloudera Observability on premises 3.7.1.

LDAP authentication fails when the LDAP server certificate has an empty Subject field
The Cloudera Observability Console Server cannot authenticate users when the TLS certificate of the LDAP server contains an empty Subject field, even if the certificate contains valid DNS subject alternative names. Authentication fails during the initial LDAP bind, and the Console Server log displays the following error: Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames: Cert is empty. This issue affects Cloudera Observability on premises 3.7.1 and all hotfix builds lower than 3.7.1-h4.
Upgrade Cloudera Observability on premises to 3.7.1-h4 or higher, which contains the fix for this issue.

If you cannot upgrade, disable certificate validation for the Console Server:

  1. In Cloudera Manager, go to Observability > Configuration.
  2. Set the scope to Console Server and the category to Advanced.
  3. Search for the Console Server Environment Advanced Configuration Snippet (Safety Valve) advanced configuration snippet.
  4. Add the following environment variable:
    • Key: NODE_TLS_REJECT_UNAUTHORIZED
    • Value: 0
  5. Save the changes and restart the Cloudera Observability Console Server.
SSL handshake failures
In Cloudera Data Services on premises environments, telemetry agent pods, such as database producer in Cloudera Data Warehouse or dbus-wxml-client in Cloudera Data Engineering can encounter an SSLHandshakeException when communicating with the DBus API. The pod logs display a PKIX path building failed error.
Cloudera Data Warehouse
  1. Download the fix_cdw_ssl.py script
  2. Export the kubeconfig env variable. Run the command export KUBECONFIG=/path/to/kube.yaml
  3. Within the Kubernetes cluster, run the command python3 fix_cdw_ssl.py --namespace [***NAMESPACE***]. For example, python3 fix_cdw_ssl.py --namespace warehouse-xodjvg-env

The script downloads the DBus API SSL certificate and adds it to the databus-producer truststore.

Cloudera Data Engineering
  1. Download the fix_cde_ssl.py script
  2. Export the kubeconfig env variable. Run the command export KUBECONFIG=/path/to/kube.yaml
  3. Within the Kubernetes cluster, run the command python3 fix_cde_ssl.py --namespace [***NAMESPACE***]. For example, python3 fix_cde_ssl.py --namespace dex-base-pc74hb7x

The script downloads the DBus API SSL certificate and adds it to the databus-producer truststore.

Impala does not support super user configuration for the observability user for Apache Ranger-enabled cluster
The observability user requires full privileges on the Observability cluster. Required services such as Kafka, HDFS, HBase, and Hive support super user setup by specifying the ranger.plugin.[service].super.users property to observability. However, this super user setup is not supported for Impala.
Manually add a new user named observability in Apache Ranger and assign full privileges.
  • For information, see Adding a user in Cloudera Base on premises documentation.
  • For information on granting user access using Apache Ranger, see Impala Authorization in Cloudera Data Warehouse Runtime for Cloudera on premises documentation.
Exporting of Impala queries fail for Telemetry Publisher with Cloudera Manager 7.11.3
Telemetry Publisher for Impala queries does not work with Cloudera Manager 7.11.3
Upgrade Cloudera Manager from 7.11.3 to 7.11.3 cumulative hotfix 6 (CHF6) version to successfully export Impala queries.
Auto Action trigger for Impala Engine
Impala Auto Action triggers do not work for the Kerberos-enabled Private Cloud base cluster running on Cloudera Manager 7.9.5 and 7.11.3.
Upgrade Cloudera Manager to 7.11.3 cumulative hotfix 9 (CHF9) version.
Telemetry publisher test altus connection fails for Cloudera Manager 7.11.3 hotfix (CHF6, 7, and 8) versions
Test connection fails with the following error: 
Exception in thread "main" java.lang.NoSuchMethodError: 'com.google.common.collect.ImmutableSet com.google.common.collect.ImmutableSet.copyOf(java.util.Collection)'
	at com.cloudera.cdp.http.HttpCodesRetryChecker.<init>(HttpCodesRetryChecker.java:57)
	at com.cloudera.cdp.client.CdpClientConfigurationBuilder.<init>(CdpClientConfigurationBuilder.java:53)
	at com.cloudera.cdp.client.CdpClientConfigurationBuilder.defaultBuilder(CdpClientConfigurationBuilder.java:400)
	at com.cloudera.cdx.client.TestDatabusConnection.main(TestDatabusConnection.java:55)

This issue only affects the test connection method.

Upgrade Cloudera Manager to 7.11.3 cumulative hotfix 9 (CHF9) version, and then start Telemetry Publisher.
Limitations of Cloudera Observability Spark processing
Spark event log processing is skipped under the following conditions:
  • The event log size exceeds 20 GB.
  • The number of Spark jobs in the Spark application exceeds 500.
  • The number of SQL executions in the Spark application exceeds 500.
  • When spark.history.fs.eventLog.rolling.maxFilesToRetain is set, Spark keeps only recent event log files as configured inspark.history.fs.eventLog.rolling.maxFilesToRetain and older event log files are compacted (in a file with .compact extension). Spark event log processing of such Spark applications are skipped by Cloudera Observability.