Grokbase Groups HBase user June 2016
FAQ
Hi,

I have configured secure HBase-1.1.3. Hadoop version using 2.7.2.

I have enabled authorization in HBase.

When executing any authorization command like user_permission, grant, revoke,
etc.

Its getting more than 40 seconds to display the result.

Below are hbase-site.xml configuration properties


<property>
     <name>hbase.master</name>
     <value>IP:60000</value>
</property>
<property>
     <name>hbase.rootdir</name>
     <value>hdfs://IP:9000/HBase</value>
</property>
<property>
     <name>hbase.cluster.distributed</name>
     <value>true</value>
</property>
<property>
     <name>hbase.zookeeper.quorum</name>
     <value>IP1:2181,IP2:2181,IP3:2181</value>
</property>
<property>
     <name>hbase.master.port</name>
     <value>60000</value>
</property>
<property>
     <name>hbase.master.info.port</name>
     <value>60010</value>
</property>
<property>
     <name>hbase.regionserver.port</name>
     <value>60020</value>
</property>
<property>
     <name>hbase.regionserver.info.port</name>
     <value>60030</value>
</property>
<property>
     <name>hbase.security.authentication</name>
     <value>KERBEROS</value>
</property>
<property>
     <name>hbase.master.keytab.file</name>
     <value>masterkeytab</value>
</property>
<property>
     <name>hbase.regionserver.keytab.file</name>
     <value>regionserverkeytab</value>
</property>
<property>
     <name>hbase.master.kerberos.principal</name>
     <value>masterprincipal</value>
</property>
<property>
     <name>hbase.regionserver.kerberos.principal</name>
     <value>regionserverprincipal</value>
</property>
<property>
     <name>hbase.rpc.engine</name>
     <value>org.apache.hadoop.hbase.ipc.SecureRpcEngine</value>
</property>
<property>
     <name>hbase.ssl.enabled</name>
     <value>true</value>
</property>
<property>
     <name>hbase.superuser</name>
     <value>@HadoopUser</value>
</property>
<property>
     <name>hbase.security.authorization</name>
     <value>true</value>
</property>
<property>
     <name>hbase.coprocessor.master.classes</name>
     <value>org.apache.hadoop.hbase.security.access.AccessController</value>
</property>
<property>
     <name>hbase.coprocessor.region.classes</name>
     <value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
</property>

Find my stack overflow question here
http://stackoverflow.com/questions/37782043/hbase-acl-commands-are-too-slow

Thanks,

Kumar

Search Discussions

  • Ted Yu at Jun 13, 2016 at 2:12 pm
    Can you inspect master log for the corresponding 40 seconds to see if there
    was some clue ?

    Feel free to pastebin the log snippet for this period if you cannot
    determine the cause.

    Cheers
    On Sun, Jun 12, 2016 at 10:19 PM, kumar r wrote:

    Hi,

    I have configured secure HBase-1.1.3. Hadoop version using 2.7.2.

    I have enabled authorization in HBase.

    When executing any authorization command like user_permission, grant,
    revoke,
    etc.

    Its getting more than 40 seconds to display the result.

    Below are hbase-site.xml configuration properties


    <property>
    <name>hbase.master</name>
    <value>IP:60000</value>
    </property>
    <property>
    <name>hbase.rootdir</name>
    <value>hdfs://IP:9000/HBase</value>
    </property>
    <property>
    <name>hbase.cluster.distributed</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.zookeeper.quorum</name>
    <value>IP1:2181,IP2:2181,IP3:2181</value>
    </property>
    <property>
    <name>hbase.master.port</name>
    <value>60000</value>
    </property>
    <property>
    <name>hbase.master.info.port</name>
    <value>60010</value>
    </property>
    <property>
    <name>hbase.regionserver.port</name>
    <value>60020</value>
    </property>
    <property>
    <name>hbase.regionserver.info.port</name>
    <value>60030</value>
    </property>
    <property>
    <name>hbase.security.authentication</name>
    <value>KERBEROS</value>
    </property>
    <property>
    <name>hbase.master.keytab.file</name>
    <value>masterkeytab</value>
    </property>
    <property>
    <name>hbase.regionserver.keytab.file</name>
    <value>regionserverkeytab</value>
    </property>
    <property>
    <name>hbase.master.kerberos.principal</name>
    <value>masterprincipal</value>
    </property>
    <property>
    <name>hbase.regionserver.kerberos.principal</name>
    <value>regionserverprincipal</value>
    </property>
    <property>
    <name>hbase.rpc.engine</name>
    <value>org.apache.hadoop.hbase.ipc.SecureRpcEngine</value>
    </property>
    <property>
    <name>hbase.ssl.enabled</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.superuser</name>
    <value>@HadoopUser</value>
    </property>
    <property>
    <name>hbase.security.authorization</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.coprocessor.master.classes</name>
    <value>org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>
    <property>
    <name>hbase.coprocessor.region.classes</name>

    <value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>

    Find my stack overflow question here
    http://stackoverflow.com/questions/37782043/hbase-acl-commands-are-too-slow

    Thanks,

    Kumar
  • Kumar r at Jun 14, 2016 at 6:56 am
    Hi,

    Thanks for the reply.

    Please find the command and time took to process it,





    *hbase(main):006:0> grant 'Selva','RW','@default'0 row(s) in 11.8830
    secondshbase(main):007:0> revoke 'Selva','@default'0 row(s) in 32.4330
    seconds*

    Find my HBase log in below pastebin

    http://pastebin.com/MHMjhHuF


    Thanks,

    Kumar

    On Mon, Jun 13, 2016 at 7:42 PM, Ted Yu wrote:

    Can you inspect master log for the corresponding 40 seconds to see if there
    was some clue ?

    Feel free to pastebin the log snippet for this period if you cannot
    determine the cause.

    Cheers
    On Sun, Jun 12, 2016 at 10:19 PM, kumar r wrote:

    Hi,

    I have configured secure HBase-1.1.3. Hadoop version using 2.7.2.

    I have enabled authorization in HBase.

    When executing any authorization command like user_permission, grant,
    revoke,
    etc.

    Its getting more than 40 seconds to display the result.

    Below are hbase-site.xml configuration properties


    <property>
    <name>hbase.master</name>
    <value>IP:60000</value>
    </property>
    <property>
    <name>hbase.rootdir</name>
    <value>hdfs://IP:9000/HBase</value>
    </property>
    <property>
    <name>hbase.cluster.distributed</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.zookeeper.quorum</name>
    <value>IP1:2181,IP2:2181,IP3:2181</value>
    </property>
    <property>
    <name>hbase.master.port</name>
    <value>60000</value>
    </property>
    <property>
    <name>hbase.master.info.port</name>
    <value>60010</value>
    </property>
    <property>
    <name>hbase.regionserver.port</name>
    <value>60020</value>
    </property>
    <property>
    <name>hbase.regionserver.info.port</name>
    <value>60030</value>
    </property>
    <property>
    <name>hbase.security.authentication</name>
    <value>KERBEROS</value>
    </property>
    <property>
    <name>hbase.master.keytab.file</name>
    <value>masterkeytab</value>
    </property>
    <property>
    <name>hbase.regionserver.keytab.file</name>
    <value>regionserverkeytab</value>
    </property>
    <property>
    <name>hbase.master.kerberos.principal</name>
    <value>masterprincipal</value>
    </property>
    <property>
    <name>hbase.regionserver.kerberos.principal</name>
    <value>regionserverprincipal</value>
    </property>
    <property>
    <name>hbase.rpc.engine</name>
    <value>org.apache.hadoop.hbase.ipc.SecureRpcEngine</value>
    </property>
    <property>
    <name>hbase.ssl.enabled</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.superuser</name>
    <value>@HadoopUser</value>
    </property>
    <property>
    <name>hbase.security.authorization</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.coprocessor.master.classes</name>
    <value>org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>
    <property>
    <name>hbase.coprocessor.region.classes</name>

    <value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>

    Find my stack overflow question here
    http://stackoverflow.com/questions/37782043/hbase-acl-commands-are-too-slow
    Thanks,

    Kumar
  • Ted Yu at Jun 14, 2016 at 2:29 pm
    bq. Opening socket connection to server machine2/192.168.60.3:2181. Will
    not attempt to authenticate using SASL (unknown error)

    It seems connection to zookeeper might have some issue.
    Can you double check configuration ?
    On Mon, Jun 13, 2016 at 11:56 PM, kumar r wrote:

    Hi,

    Thanks for the reply.

    Please find the command and time took to process it,





    *hbase(main):006:0> grant 'Selva','RW','@default'0 row(s) in 11.8830
    secondshbase(main):007:0> revoke 'Selva','@default'0 row(s) in 32.4330
    seconds*

    Find my HBase log in below pastebin

    http://pastebin.com/MHMjhHuF


    Thanks,

    Kumar

    On Mon, Jun 13, 2016 at 7:42 PM, Ted Yu wrote:

    Can you inspect master log for the corresponding 40 seconds to see if there
    was some clue ?

    Feel free to pastebin the log snippet for this period if you cannot
    determine the cause.

    Cheers
    On Sun, Jun 12, 2016 at 10:19 PM, kumar r wrote:

    Hi,

    I have configured secure HBase-1.1.3. Hadoop version using 2.7.2.

    I have enabled authorization in HBase.

    When executing any authorization command like user_permission, grant,
    revoke,
    etc.

    Its getting more than 40 seconds to display the result.

    Below are hbase-site.xml configuration properties


    <property>
    <name>hbase.master</name>
    <value>IP:60000</value>
    </property>
    <property>
    <name>hbase.rootdir</name>
    <value>hdfs://IP:9000/HBase</value>
    </property>
    <property>
    <name>hbase.cluster.distributed</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.zookeeper.quorum</name>
    <value>IP1:2181,IP2:2181,IP3:2181</value>
    </property>
    <property>
    <name>hbase.master.port</name>
    <value>60000</value>
    </property>
    <property>
    <name>hbase.master.info.port</name>
    <value>60010</value>
    </property>
    <property>
    <name>hbase.regionserver.port</name>
    <value>60020</value>
    </property>
    <property>
    <name>hbase.regionserver.info.port</name>
    <value>60030</value>
    </property>
    <property>
    <name>hbase.security.authentication</name>
    <value>KERBEROS</value>
    </property>
    <property>
    <name>hbase.master.keytab.file</name>
    <value>masterkeytab</value>
    </property>
    <property>
    <name>hbase.regionserver.keytab.file</name>
    <value>regionserverkeytab</value>
    </property>
    <property>
    <name>hbase.master.kerberos.principal</name>
    <value>masterprincipal</value>
    </property>
    <property>
    <name>hbase.regionserver.kerberos.principal</name>
    <value>regionserverprincipal</value>
    </property>
    <property>
    <name>hbase.rpc.engine</name>
    <value>org.apache.hadoop.hbase.ipc.SecureRpcEngine</value>
    </property>
    <property>
    <name>hbase.ssl.enabled</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.superuser</name>
    <value>@HadoopUser</value>
    </property>
    <property>
    <name>hbase.security.authorization</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.coprocessor.master.classes</name>
    <value>org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>
    <property>
    <name>hbase.coprocessor.region.classes</name>
    <value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>

    Find my stack overflow question here
    http://stackoverflow.com/questions/37782043/hbase-acl-commands-are-too-slow
    Thanks,

    Kumar
  • Kumar r at Jun 15, 2016 at 9:13 am
    Hi Ted,

    Thanks for your reply.

    I cannot find anything in configuration. Can you tell me what might be root
    cause for this issue?

    What will be major cause for acl command taking more than 30 seconds to
    process. I cannot find anything other than this in hbase log. Is there any
    documentation available to secure zookeeper and hbase with kerberos
    properly?

    The same log occurs in normal cluster also and i have enabled
    authorization. The same authorization command runs in 5 to 6 seconds.

    Thanks,
    Kumar
    On Tue, Jun 14, 2016 at 7:59 PM, Ted Yu wrote:

    bq. Opening socket connection to server machine2/192.168.60.3:2181. Will
    not attempt to authenticate using SASL (unknown error)

    It seems connection to zookeeper might have some issue.
    Can you double check configuration ?
    On Mon, Jun 13, 2016 at 11:56 PM, kumar r wrote:

    Hi,

    Thanks for the reply.

    Please find the command and time took to process it,





    *hbase(main):006:0> grant 'Selva','RW','@default'0 row(s) in 11.8830
    secondshbase(main):007:0> revoke 'Selva','@default'0 row(s) in 32.4330
    seconds*

    Find my HBase log in below pastebin

    http://pastebin.com/MHMjhHuF


    Thanks,

    Kumar

    On Mon, Jun 13, 2016 at 7:42 PM, Ted Yu wrote:

    Can you inspect master log for the corresponding 40 seconds to see if there
    was some clue ?

    Feel free to pastebin the log snippet for this period if you cannot
    determine the cause.

    Cheers
    On Sun, Jun 12, 2016 at 10:19 PM, kumar r wrote:

    Hi,

    I have configured secure HBase-1.1.3. Hadoop version using 2.7.2.

    I have enabled authorization in HBase.

    When executing any authorization command like user_permission, grant,
    revoke,
    etc.

    Its getting more than 40 seconds to display the result.

    Below are hbase-site.xml configuration properties


    <property>
    <name>hbase.master</name>
    <value>IP:60000</value>
    </property>
    <property>
    <name>hbase.rootdir</name>
    <value>hdfs://IP:9000/HBase</value>
    </property>
    <property>
    <name>hbase.cluster.distributed</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.zookeeper.quorum</name>
    <value>IP1:2181,IP2:2181,IP3:2181</value>
    </property>
    <property>
    <name>hbase.master.port</name>
    <value>60000</value>
    </property>
    <property>
    <name>hbase.master.info.port</name>
    <value>60010</value>
    </property>
    <property>
    <name>hbase.regionserver.port</name>
    <value>60020</value>
    </property>
    <property>
    <name>hbase.regionserver.info.port</name>
    <value>60030</value>
    </property>
    <property>
    <name>hbase.security.authentication</name>
    <value>KERBEROS</value>
    </property>
    <property>
    <name>hbase.master.keytab.file</name>
    <value>masterkeytab</value>
    </property>
    <property>
    <name>hbase.regionserver.keytab.file</name>
    <value>regionserverkeytab</value>
    </property>
    <property>
    <name>hbase.master.kerberos.principal</name>
    <value>masterprincipal</value>
    </property>
    <property>
    <name>hbase.regionserver.kerberos.principal</name>
    <value>regionserverprincipal</value>
    </property>
    <property>
    <name>hbase.rpc.engine</name>
    <value>org.apache.hadoop.hbase.ipc.SecureRpcEngine</value>
    </property>
    <property>
    <name>hbase.ssl.enabled</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.superuser</name>
    <value>@HadoopUser</value>
    </property>
    <property>
    <name>hbase.security.authorization</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.coprocessor.master.classes</name>
    <value>org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>
    <property>
    <name>hbase.coprocessor.region.classes</name>
    <value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>

    Find my stack overflow question here
    http://stackoverflow.com/questions/37782043/hbase-acl-commands-are-too-slow
    Thanks,

    Kumar
  • Ted Yu at Jun 15, 2016 at 2:26 pm
    Have you looked at http://hbase.apache.org/book.html#security ?

    I noticed that DEBUG logging was not on in the log you posted earlier.
    Is it possible to turn on DEBUG logging and repeat the operation ?

    Thanks
    On Wed, Jun 15, 2016 at 2:12 AM, kumar r wrote:

    Hi Ted,

    Thanks for your reply.

    I cannot find anything in configuration. Can you tell me what might be root
    cause for this issue?

    What will be major cause for acl command taking more than 30 seconds to
    process. I cannot find anything other than this in hbase log. Is there any
    documentation available to secure zookeeper and hbase with kerberos
    properly?

    The same log occurs in normal cluster also and i have enabled
    authorization. The same authorization command runs in 5 to 6 seconds.

    Thanks,
    Kumar
    On Tue, Jun 14, 2016 at 7:59 PM, Ted Yu wrote:

    bq. Opening socket connection to server machine2/192.168.60.3:2181. Will
    not attempt to authenticate using SASL (unknown error)

    It seems connection to zookeeper might have some issue.
    Can you double check configuration ?
    On Mon, Jun 13, 2016 at 11:56 PM, kumar r wrote:

    Hi,

    Thanks for the reply.

    Please find the command and time took to process it,





    *hbase(main):006:0> grant 'Selva','RW','@default'0 row(s) in 11.8830
    secondshbase(main):007:0> revoke 'Selva','@default'0 row(s) in 32.4330
    seconds*

    Find my HBase log in below pastebin

    http://pastebin.com/MHMjhHuF


    Thanks,

    Kumar

    On Mon, Jun 13, 2016 at 7:42 PM, Ted Yu wrote:

    Can you inspect master log for the corresponding 40 seconds to see if there
    was some clue ?

    Feel free to pastebin the log snippet for this period if you cannot
    determine the cause.

    Cheers
    On Sun, Jun 12, 2016 at 10:19 PM, kumar r wrote:

    Hi,

    I have configured secure HBase-1.1.3. Hadoop version using 2.7.2.

    I have enabled authorization in HBase.

    When executing any authorization command like user_permission,
    grant,
    revoke,
    etc.

    Its getting more than 40 seconds to display the result.

    Below are hbase-site.xml configuration properties


    <property>
    <name>hbase.master</name>
    <value>IP:60000</value>
    </property>
    <property>
    <name>hbase.rootdir</name>
    <value>hdfs://IP:9000/HBase</value>
    </property>
    <property>
    <name>hbase.cluster.distributed</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.zookeeper.quorum</name>
    <value>IP1:2181,IP2:2181,IP3:2181</value>
    </property>
    <property>
    <name>hbase.master.port</name>
    <value>60000</value>
    </property>
    <property>
    <name>hbase.master.info.port</name>
    <value>60010</value>
    </property>
    <property>
    <name>hbase.regionserver.port</name>
    <value>60020</value>
    </property>
    <property>
    <name>hbase.regionserver.info.port</name>
    <value>60030</value>
    </property>
    <property>
    <name>hbase.security.authentication</name>
    <value>KERBEROS</value>
    </property>
    <property>
    <name>hbase.master.keytab.file</name>
    <value>masterkeytab</value>
    </property>
    <property>
    <name>hbase.regionserver.keytab.file</name>
    <value>regionserverkeytab</value>
    </property>
    <property>
    <name>hbase.master.kerberos.principal</name>
    <value>masterprincipal</value>
    </property>
    <property>
    <name>hbase.regionserver.kerberos.principal</name>
    <value>regionserverprincipal</value>
    </property>
    <property>
    <name>hbase.rpc.engine</name>
    <value>org.apache.hadoop.hbase.ipc.SecureRpcEngine</value>
    </property>
    <property>
    <name>hbase.ssl.enabled</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.superuser</name>
    <value>@HadoopUser</value>
    </property>
    <property>
    <name>hbase.security.authorization</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.coprocessor.master.classes</name>
    <value>org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>
    <property>
    <name>hbase.coprocessor.region.classes</name>
    <value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>

    Find my stack overflow question here
    http://stackoverflow.com/questions/37782043/hbase-acl-commands-are-too-slow
    Thanks,

    Kumar
  • Kumar r at Jun 17, 2016 at 10:48 am
    Hi,

    Please find the log,

    http://pastebin.com/Bc3ywAQQ







    *hbase(main):007:0> grant 'Selva','RWXCA','@default'0 row(s) in 21.4610
    secondshbase(main):008:0> revoke 'Selva','@default'0 row(s) in 31.8870
    seconds*
    Thanks,
    Kumar
    On Wed, Jun 15, 2016 at 7:56 PM, Ted Yu wrote:

    Have you looked at http://hbase.apache.org/book.html#security ?

    I noticed that DEBUG logging was not on in the log you posted earlier.
    Is it possible to turn on DEBUG logging and repeat the operation ?

    Thanks
    On Wed, Jun 15, 2016 at 2:12 AM, kumar r wrote:

    Hi Ted,

    Thanks for your reply.

    I cannot find anything in configuration. Can you tell me what might be root
    cause for this issue?

    What will be major cause for acl command taking more than 30 seconds to
    process. I cannot find anything other than this in hbase log. Is there any
    documentation available to secure zookeeper and hbase with kerberos
    properly?

    The same log occurs in normal cluster also and i have enabled
    authorization. The same authorization command runs in 5 to 6 seconds.

    Thanks,
    Kumar
    On Tue, Jun 14, 2016 at 7:59 PM, Ted Yu wrote:

    bq. Opening socket connection to server machine2/192.168.60.3:2181. Will
    not attempt to authenticate using SASL (unknown error)

    It seems connection to zookeeper might have some issue.
    Can you double check configuration ?
    On Mon, Jun 13, 2016 at 11:56 PM, kumar r wrote:

    Hi,

    Thanks for the reply.

    Please find the command and time took to process it,





    *hbase(main):006:0> grant 'Selva','RW','@default'0 row(s) in 11.8830
    secondshbase(main):007:0> revoke 'Selva','@default'0 row(s) in
    32.4330
    seconds*

    Find my HBase log in below pastebin

    http://pastebin.com/MHMjhHuF


    Thanks,

    Kumar

    On Mon, Jun 13, 2016 at 7:42 PM, Ted Yu wrote:

    Can you inspect master log for the corresponding 40 seconds to see
    if
    there
    was some clue ?

    Feel free to pastebin the log snippet for this period if you cannot
    determine the cause.

    Cheers

    On Sun, Jun 12, 2016 at 10:19 PM, kumar r <kumarccpp@gmail.com>
    wrote:
    Hi,

    I have configured secure HBase-1.1.3. Hadoop version using 2.7.2.

    I have enabled authorization in HBase.

    When executing any authorization command like user_permission,
    grant,
    revoke,
    etc.

    Its getting more than 40 seconds to display the result.

    Below are hbase-site.xml configuration properties


    <property>
    <name>hbase.master</name>
    <value>IP:60000</value>
    </property>
    <property>
    <name>hbase.rootdir</name>
    <value>hdfs://IP:9000/HBase</value>
    </property>
    <property>
    <name>hbase.cluster.distributed</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.zookeeper.quorum</name>
    <value>IP1:2181,IP2:2181,IP3:2181</value>
    </property>
    <property>
    <name>hbase.master.port</name>
    <value>60000</value>
    </property>
    <property>
    <name>hbase.master.info.port</name>
    <value>60010</value>
    </property>
    <property>
    <name>hbase.regionserver.port</name>
    <value>60020</value>
    </property>
    <property>
    <name>hbase.regionserver.info.port</name>
    <value>60030</value>
    </property>
    <property>
    <name>hbase.security.authentication</name>
    <value>KERBEROS</value>
    </property>
    <property>
    <name>hbase.master.keytab.file</name>
    <value>masterkeytab</value>
    </property>
    <property>
    <name>hbase.regionserver.keytab.file</name>
    <value>regionserverkeytab</value>
    </property>
    <property>
    <name>hbase.master.kerberos.principal</name>
    <value>masterprincipal</value>
    </property>
    <property>
    <name>hbase.regionserver.kerberos.principal</name>
    <value>regionserverprincipal</value>
    </property>
    <property>
    <name>hbase.rpc.engine</name>
    <value>org.apache.hadoop.hbase.ipc.SecureRpcEngine</value>
    </property>
    <property>
    <name>hbase.ssl.enabled</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.superuser</name>
    <value>@HadoopUser</value>
    </property>
    <property>
    <name>hbase.security.authorization</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.coprocessor.master.classes</name>
    <value>org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>
    <property>
    <name>hbase.coprocessor.region.classes</name>
    <value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>

    Find my stack overflow question here
    http://stackoverflow.com/questions/37782043/hbase-acl-commands-are-too-slow
    Thanks,

    Kumar
  • Ted Yu at Jun 17, 2016 at 7:15 pm
    I have gone through the log but haven't identified the cause.

    Can you outline the time range for the 30 second response so that I can
    correlate with the log ?

    Is communication with zookeeper quorum working without noticeable delay ?

    Thanks
    On Fri, Jun 17, 2016 at 3:47 AM, kumar r wrote:

    Hi,

    Please find the log,

    http://pastebin.com/Bc3ywAQQ







    *hbase(main):007:0> grant 'Selva','RWXCA','@default'0 row(s) in 21.4610
    secondshbase(main):008:0> revoke 'Selva','@default'0 row(s) in 31.8870
    seconds*
    Thanks,
    Kumar
    On Wed, Jun 15, 2016 at 7:56 PM, Ted Yu wrote:

    Have you looked at http://hbase.apache.org/book.html#security ?

    I noticed that DEBUG logging was not on in the log you posted earlier.
    Is it possible to turn on DEBUG logging and repeat the operation ?

    Thanks
    On Wed, Jun 15, 2016 at 2:12 AM, kumar r wrote:

    Hi Ted,

    Thanks for your reply.

    I cannot find anything in configuration. Can you tell me what might be root
    cause for this issue?

    What will be major cause for acl command taking more than 30 seconds to
    process. I cannot find anything other than this in hbase log. Is there any
    documentation available to secure zookeeper and hbase with kerberos
    properly?

    The same log occurs in normal cluster also and i have enabled
    authorization. The same authorization command runs in 5 to 6 seconds.

    Thanks,
    Kumar
    On Tue, Jun 14, 2016 at 7:59 PM, Ted Yu wrote:

    bq. Opening socket connection to server machine2/192.168.60.3:2181. Will
    not attempt to authenticate using SASL (unknown error)

    It seems connection to zookeeper might have some issue.
    Can you double check configuration ?
    On Mon, Jun 13, 2016 at 11:56 PM, kumar r wrote:

    Hi,

    Thanks for the reply.

    Please find the command and time took to process it,





    *hbase(main):006:0> grant 'Selva','RW','@default'0 row(s) in
    11.8830
    secondshbase(main):007:0> revoke 'Selva','@default'0 row(s) in
    32.4330
    seconds*

    Find my HBase log in below pastebin

    http://pastebin.com/MHMjhHuF


    Thanks,

    Kumar

    On Mon, Jun 13, 2016 at 7:42 PM, Ted Yu wrote:

    Can you inspect master log for the corresponding 40 seconds to
    see
    if
    there
    was some clue ?

    Feel free to pastebin the log snippet for this period if you
    cannot
    determine the cause.

    Cheers

    On Sun, Jun 12, 2016 at 10:19 PM, kumar r <kumarccpp@gmail.com>
    wrote:
    Hi,

    I have configured secure HBase-1.1.3. Hadoop version using
    2.7.2.
    I have enabled authorization in HBase.

    When executing any authorization command like user_permission,
    grant,
    revoke,
    etc.

    Its getting more than 40 seconds to display the result.

    Below are hbase-site.xml configuration properties


    <property>
    <name>hbase.master</name>
    <value>IP:60000</value>
    </property>
    <property>
    <name>hbase.rootdir</name>
    <value>hdfs://IP:9000/HBase</value>
    </property>
    <property>
    <name>hbase.cluster.distributed</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.zookeeper.quorum</name>
    <value>IP1:2181,IP2:2181,IP3:2181</value>
    </property>
    <property>
    <name>hbase.master.port</name>
    <value>60000</value>
    </property>
    <property>
    <name>hbase.master.info.port</name>
    <value>60010</value>
    </property>
    <property>
    <name>hbase.regionserver.port</name>
    <value>60020</value>
    </property>
    <property>
    <name>hbase.regionserver.info.port</name>
    <value>60030</value>
    </property>
    <property>
    <name>hbase.security.authentication</name>
    <value>KERBEROS</value>
    </property>
    <property>
    <name>hbase.master.keytab.file</name>
    <value>masterkeytab</value>
    </property>
    <property>
    <name>hbase.regionserver.keytab.file</name>
    <value>regionserverkeytab</value>
    </property>
    <property>
    <name>hbase.master.kerberos.principal</name>
    <value>masterprincipal</value>
    </property>
    <property>
    <name>hbase.regionserver.kerberos.principal</name>
    <value>regionserverprincipal</value>
    </property>
    <property>
    <name>hbase.rpc.engine</name>
    <value>org.apache.hadoop.hbase.ipc.SecureRpcEngine</value>
    </property>
    <property>
    <name>hbase.ssl.enabled</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.superuser</name>
    <value>@HadoopUser</value>
    </property>
    <property>
    <name>hbase.security.authorization</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.coprocessor.master.classes</name>
    <value>org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>
    <property>
    <name>hbase.coprocessor.region.classes</name>
    <value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>

    Find my stack overflow question here
    http://stackoverflow.com/questions/37782043/hbase-acl-commands-are-too-slow
    Thanks,

    Kumar
  • Kumar r at Jun 18, 2016 at 4:07 am
    Hi,

    I don't think the problem from zookeeper quorum.

    Create, scan and list commands are working without delay. It won't take
    more than 5 seconds.

    But when executing acl commands getting slow response.

    I have noticed in log as *auth: SIMPLE *but actually it should be
    *KERBEROS *authentication.

    [image: Inline image 2]

    And getting a warning message as "*responseTooSlow*"

    [image: Inline image 3]

    Hope this will help you to figure the issue.

    Thanks,
    Kumar
    On Sat, Jun 18, 2016 at 12:45 AM, Ted Yu wrote:

    I have gone through the log but haven't identified the cause.

    Can you outline the time range for the 30 second response so that I can
    correlate with the log ?

    Is communication with zookeeper quorum working without noticeable delay ?

    Thanks
    On Fri, Jun 17, 2016 at 3:47 AM, kumar r wrote:

    Hi,

    Please find the log,

    http://pastebin.com/Bc3ywAQQ







    *hbase(main):007:0> grant 'Selva','RWXCA','@default'0 row(s) in 21.4610
    secondshbase(main):008:0> revoke 'Selva','@default'0 row(s) in 31.8870
    seconds*
    Thanks,
    Kumar
    On Wed, Jun 15, 2016 at 7:56 PM, Ted Yu wrote:

    Have you looked at http://hbase.apache.org/book.html#security ?

    I noticed that DEBUG logging was not on in the log you posted earlier.
    Is it possible to turn on DEBUG logging and repeat the operation ?

    Thanks
    On Wed, Jun 15, 2016 at 2:12 AM, kumar r wrote:

    Hi Ted,

    Thanks for your reply.

    I cannot find anything in configuration. Can you tell me what might
    be
    root
    cause for this issue?

    What will be major cause for acl command taking more than 30 seconds
    to
    process. I cannot find anything other than this in hbase log. Is
    there
    any
    documentation available to secure zookeeper and hbase with kerberos
    properly?

    The same log occurs in normal cluster also and i have enabled
    authorization. The same authorization command runs in 5 to 6 seconds.

    Thanks,
    Kumar
    On Tue, Jun 14, 2016 at 7:59 PM, Ted Yu wrote:

    bq. Opening socket connection to server machine2/
    192.168.60.3:2181.
    Will
    not attempt to authenticate using SASL (unknown error)

    It seems connection to zookeeper might have some issue.
    Can you double check configuration ?

    On Mon, Jun 13, 2016 at 11:56 PM, kumar r <kumarccpp@gmail.com>
    wrote:
    Hi,

    Thanks for the reply.

    Please find the command and time took to process it,





    *hbase(main):006:0> grant 'Selva','RW','@default'0 row(s) in
    11.8830
    secondshbase(main):007:0> revoke 'Selva','@default'0 row(s) in
    32.4330
    seconds*

    Find my HBase log in below pastebin

    http://pastebin.com/MHMjhHuF


    Thanks,

    Kumar


    On Mon, Jun 13, 2016 at 7:42 PM, Ted Yu <yuzhihong@gmail.com>
    wrote:
    Can you inspect master log for the corresponding 40 seconds to
    see
    if
    there
    was some clue ?

    Feel free to pastebin the log snippet for this period if you
    cannot
    determine the cause.

    Cheers

    On Sun, Jun 12, 2016 at 10:19 PM, kumar r <kumarccpp@gmail.com
    wrote:
    Hi,

    I have configured secure HBase-1.1.3. Hadoop version using
    2.7.2.
    I have enabled authorization in HBase.

    When executing any authorization command like
    user_permission,
    grant,
    revoke,
    etc.

    Its getting more than 40 seconds to display the result.

    Below are hbase-site.xml configuration properties


    <property>
    <name>hbase.master</name>
    <value>IP:60000</value>
    </property>
    <property>
    <name>hbase.rootdir</name>
    <value>hdfs://IP:9000/HBase</value>
    </property>
    <property>
    <name>hbase.cluster.distributed</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.zookeeper.quorum</name>
    <value>IP1:2181,IP2:2181,IP3:2181</value>
    </property>
    <property>
    <name>hbase.master.port</name>
    <value>60000</value>
    </property>
    <property>
    <name>hbase.master.info.port</name>
    <value>60010</value>
    </property>
    <property>
    <name>hbase.regionserver.port</name>
    <value>60020</value>
    </property>
    <property>
    <name>hbase.regionserver.info.port</name>
    <value>60030</value>
    </property>
    <property>
    <name>hbase.security.authentication</name>
    <value>KERBEROS</value>
    </property>
    <property>
    <name>hbase.master.keytab.file</name>
    <value>masterkeytab</value>
    </property>
    <property>
    <name>hbase.regionserver.keytab.file</name>
    <value>regionserverkeytab</value>
    </property>
    <property>
    <name>hbase.master.kerberos.principal</name>
    <value>masterprincipal</value>
    </property>
    <property>
    <name>hbase.regionserver.kerberos.principal</name>
    <value>regionserverprincipal</value>
    </property>
    <property>
    <name>hbase.rpc.engine</name>
    <value>org.apache.hadoop.hbase.ipc.SecureRpcEngine</value>
    </property>
    <property>
    <name>hbase.ssl.enabled</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.superuser</name>
    <value>@HadoopUser</value>
    </property>
    <property>
    <name>hbase.security.authorization</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.coprocessor.master.classes</name>
    <value>org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>
    <property>
    <name>hbase.coprocessor.region.classes</name>
    <value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>

    Find my stack overflow question here
    http://stackoverflow.com/questions/37782043/hbase-acl-commands-are-too-slow
    Thanks,

    Kumar
  • Ted Yu at Jun 18, 2016 at 1:13 pm
    Images didn't come through.

    Consider using third party site and send links.

    I don't know why hbase.rpc.engine was in hbase-site.xml
    It is not used by hbase 1.1
    Though this didn't seem to be the cause.

    Cheers
    On Jun 17, 2016, at 9:06 PM, kumar r wrote:

    Hi,

    I don't think the problem from zookeeper quorum.

    Create, scan and list commands are working without delay. It won't take more than 5 seconds.

    But when executing acl commands getting slow response.

    I have noticed in log as auth: SIMPLE but actually it should be KERBEROS authentication.



    And getting a warning message as "responseTooSlow"



    Hope this will help you to figure the issue.

    Thanks,
    Kumar
    On Sat, Jun 18, 2016 at 12:45 AM, Ted Yu wrote:
    I have gone through the log but haven't identified the cause.

    Can you outline the time range for the 30 second response so that I can
    correlate with the log ?

    Is communication with zookeeper quorum working without noticeable delay ?

    Thanks
    On Fri, Jun 17, 2016 at 3:47 AM, kumar r wrote:

    Hi,

    Please find the log,

    http://pastebin.com/Bc3ywAQQ







    *hbase(main):007:0> grant 'Selva','RWXCA','@default'0 row(s) in 21.4610
    secondshbase(main):008:0> revoke 'Selva','@default'0 row(s) in 31.8870
    seconds*
    Thanks,
    Kumar
    On Wed, Jun 15, 2016 at 7:56 PM, Ted Yu wrote:

    Have you looked at http://hbase.apache.org/book.html#security ?

    I noticed that DEBUG logging was not on in the log you posted earlier.
    Is it possible to turn on DEBUG logging and repeat the operation ?

    Thanks
    On Wed, Jun 15, 2016 at 2:12 AM, kumar r wrote:

    Hi Ted,

    Thanks for your reply.

    I cannot find anything in configuration. Can you tell me what might be root
    cause for this issue?

    What will be major cause for acl command taking more than 30 seconds to
    process. I cannot find anything other than this in hbase log. Is there any
    documentation available to secure zookeeper and hbase with kerberos
    properly?

    The same log occurs in normal cluster also and i have enabled
    authorization. The same authorization command runs in 5 to 6 seconds.

    Thanks,
    Kumar
    On Tue, Jun 14, 2016 at 7:59 PM, Ted Yu wrote:

    bq. Opening socket connection to server machine2/192.168.60.3:2181. Will
    not attempt to authenticate using SASL (unknown error)

    It seems connection to zookeeper might have some issue.
    Can you double check configuration ?

    On Mon, Jun 13, 2016 at 11:56 PM, kumar r <kumarccpp@gmail.com>
    wrote:
    Hi,

    Thanks for the reply.

    Please find the command and time took to process it,





    *hbase(main):006:0> grant 'Selva','RW','@default'0 row(s) in
    11.8830
    secondshbase(main):007:0> revoke 'Selva','@default'0 row(s) in
    32.4330
    seconds*

    Find my HBase log in below pastebin

    http://pastebin.com/MHMjhHuF


    Thanks,

    Kumar


    On Mon, Jun 13, 2016 at 7:42 PM, Ted Yu <yuzhihong@gmail.com>
    wrote:
    Can you inspect master log for the corresponding 40 seconds to
    see
    if
    there
    was some clue ?

    Feel free to pastebin the log snippet for this period if you
    cannot
    determine the cause.

    Cheers

    On Sun, Jun 12, 2016 at 10:19 PM, kumar r <kumarccpp@gmail.com>
    wrote:
    Hi,

    I have configured secure HBase-1.1.3. Hadoop version using
    2.7.2.
    I have enabled authorization in HBase.

    When executing any authorization command like user_permission,
    grant,
    revoke,
    etc.

    Its getting more than 40 seconds to display the result.

    Below are hbase-site.xml configuration properties


    <property>
    <name>hbase.master</name>
    <value>IP:60000</value>
    </property>
    <property>
    <name>hbase.rootdir</name>
    <value>hdfs://IP:9000/HBase</value>
    </property>
    <property>
    <name>hbase.cluster.distributed</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.zookeeper.quorum</name>
    <value>IP1:2181,IP2:2181,IP3:2181</value>
    </property>
    <property>
    <name>hbase.master.port</name>
    <value>60000</value>
    </property>
    <property>
    <name>hbase.master.info.port</name>
    <value>60010</value>
    </property>
    <property>
    <name>hbase.regionserver.port</name>
    <value>60020</value>
    </property>
    <property>
    <name>hbase.regionserver.info.port</name>
    <value>60030</value>
    </property>
    <property>
    <name>hbase.security.authentication</name>
    <value>KERBEROS</value>
    </property>
    <property>
    <name>hbase.master.keytab.file</name>
    <value>masterkeytab</value>
    </property>
    <property>
    <name>hbase.regionserver.keytab.file</name>
    <value>regionserverkeytab</value>
    </property>
    <property>
    <name>hbase.master.kerberos.principal</name>
    <value>masterprincipal</value>
    </property>
    <property>
    <name>hbase.regionserver.kerberos.principal</name>
    <value>regionserverprincipal</value>
    </property>
    <property>
    <name>hbase.rpc.engine</name>
    <value>org.apache.hadoop.hbase.ipc.SecureRpcEngine</value>
    </property>
    <property>
    <name>hbase.ssl.enabled</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.superuser</name>
    <value>@HadoopUser</value>
    </property>
    <property>
    <name>hbase.security.authorization</name>
    <value>true</value>
    </property>
    <property>
    <name>hbase.coprocessor.master.classes</name>
    <value>org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>
    <property>
    <name>hbase.coprocessor.region.classes</name>
    <value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
    </property>

    Find my stack overflow question here
    http://stackoverflow.com/questions/37782043/hbase-acl-commands-are-too-slow
    Thanks,

    Kumar

Related Discussions

Discussion Navigation
viewthread | post
Discussion Overview
groupuser @
categorieshbase, hadoop
postedJun 13, '16 at 5:19a
activeJun 18, '16 at 1:13p
posts10
users2
websitehbase.apache.org

2 users in discussion

Ted Yu: 5 posts Kumar r: 5 posts

People

Translate

site design / logo © 2018 Grokbase