[jira] [Created] (EAGLE-48) Alert message time is wrong in some cases

["Zhao, Qingwen (JIRA)" <ji...@apache.org>]

Zhao, Qingwen created EAGLE-48:
----------------------------------

             Summary: Alert message time is wrong in some cases
                 Key: EAGLE-48
                 URL: https://issues.apache.org/jira/browse/EAGLE-48
             Project: Eagle
          Issue Type: Bug
         Environment: hortonworrks sandbox
            Reporter: Zhao, Qingwen


Today I test HDFS security log topology, and create a policy “hdfs security"

from hdfsSecurityLogEventStream[(allowed == false) and (user == 'hbase')]#window.externalTime(timestamp,10 min) select user, count(timestamp) as aggValue group by user having aggValue >= 2 insert into outputStream;

And found the alert message time is always 1970-01-01 00:00:00[UTC]. The importing log is 

2015-11-18 08:41:10,200 INFO SecurityLogger.org.apache.hadoop.security.authorize.ServiceAuthorizationManager: Authorization failed for hbase (auth:SIMPLE) for protocol=interface org.apache.hadoop.hdfs.protocol.ClientProtocol

Check the parsing code, found no problem. Then I create another testing policy “testAnother"

from hdfsSecurityLogEventStream[(allowed == false) and (user == 'hbase')] select * insert into outputStream;

This time the message time is OK. 



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)