[jira] [Commented] (HDFS-16266) Add remote port information to HDFS audit log

["Wei-Chiu Chuang (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/HDFS-16266?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17433608#comment-17433608 ] 

Wei-Chiu Chuang commented on HDFS-16266:
----------------------------------------

Thanks for reporting the issue and submitting the PR.

So, I have a few design/architectural comments other than the code attached in the PR.

1. for the abusive users, have you tried enable FairCallQueue to punish those bad users? If so, did you find it not sufficient to combat resource usage problem? Is it because the users issued recursive commands like 'du' (contentSummary) calls?
2. the current audit logger supports CallerContext. Applications (e.g. Hive) that support this semantics can attach a signature that is then passed from application to namenode. IMO this is a more explicit way to do post-moretem.

> Add remote port information to HDFS audit log
> ---------------------------------------------
>
>                 Key: HDFS-16266
>                 URL: https://issues.apache.org/jira/browse/HDFS-16266
>             Project: Hadoop HDFS
>          Issue Type: Improvement
>            Reporter: tomscut
>            Assignee: tomscut
>            Priority: Major
>              Labels: pull-request-available
>          Time Spent: 3h 40m
>  Remaining Estimate: 0h
>
> In our production environment, we occasionally encounter a problem where a user submits an abnormal computation task, causing a sudden flood of requests, which causes the queueTime and processingTime of the Namenode to rise very high, causing a large backlog of tasks.
> We usually locate and kill specific Spark, Flink, or MapReduce tasks based on metrics and audit logs. Currently, IP and UGI are recorded in audit logs, but there is no port information, so it is difficult to locate specific processes sometimes. Therefore, I propose that we add the port information to the audit log, so that we can easily track the upstream process.
> Currently, some projects contain port information in audit logs, such as Hbase and Alluxio. I think it is also necessary to add port information for HDFS audit logs.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: hdfs-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: hdfs-issues-help@hadoop.apache.org