[jira] [Created] (IMPALA-8838) Impala wrote audit log with missing statement_type

["Tim Armstrong (JIRA)" <ji...@apache.org>]

Tim Armstrong created IMPALA-8838:
-------------------------------------

             Summary: Impala wrote audit log with missing statement_type
                 Key: IMPALA-8838
                 URL: https://issues.apache.org/jira/browse/IMPALA-8838
             Project: IMPALA
          Issue Type: Bug
    Affects Versions: Impala 2.9.0
            Reporter: Tim Armstrong


We saw an audit log with a missing statement_type, where it should have been QUERY. Filing a bug to see if this reoccurs and if there is a pattern to it (we don't have a way to reproduce or debug now).

{noformat}
{
  "serviceType": "IMPALA", 
  "serviceName": "impala", 
  "extraValues": {
    "12345678912345": {
      "status": "", 
      "impersonator": null, 
      "start_time": "2019-01-01 00:00:00.000000000", 
      "network_address": "123.123.123.123:12345", 
      "authorization_failure": false, 
      "sql_statement": "SELECT NDV_NO_FINALIZE(col) AS col, CAST(-1 as BIGINT), 8, CAST(8 as DOUBLE), COUNT(col), ... FROM table WHERE (day='2019-01-01') GROUP BY day",
      "session_id\\ ": "xxxxxxxxxxxxxx:xxxxxxxxxxxxxx", 
      "query_id": "xxxxxxxxxxxxxxx:xxxxxxxxxxxxxx", 
      "catalog_objects": [
        {
          "privilege": "VIEW_METADATA", 
          "object_type": "", 
          "name": "_impala_builtins"
        }, 
        {
          "privilege": "SELECT", 
          " object_type": "", 
          "name": "table"
        }
      ], 
      "statement_type": "", 
      "user": "user@REALM.NET"
    }
  }
}
{noformat}

statement_type is printed here:
https://github.com/cloudera/Impala/blob/cdh5-2.9.0_5.12.2/be/src/service/impala-server.cc#L474

It calls out to the function which prints an enum here:https://github.com/cloudera/Impala/blob/cdh5-2.9.0_5.12.2/be/src/util/debug-util.cc#L68. The only way it can produce an empty string is if the enum value is out-of-range, which shouldn't be possible unless we're reading an uninitialised value or the memory is somehow corrupted. However, all the surrounding fields in the TExecRequest object look like they were written out to the audit log OK

The code has changed a bit in master because of the thrift version upgrade, but it is still equivalent as far as I can see.




--
This message was sent by Atlassian JIRA
(v7.6.14#76016)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscribe@impala.apache.org
For additional commands, e-mail: issues-all-help@impala.apache.org