Mailing-List: contact user-help@hbase.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@hbase.apache.org
MIME-Version: 1.0
In-Reply-To: <CAL8XniqqgnkQ=CiBSzpi9a6up=x8JJ0QPCU_HMFA+n4yrg5BfQ@mail.gmail.com>
References: <CAL8XnipyhaDnMudLWZUkathiqapNNQYnXxAo=tBEMiV_xWacJg@mail.gmail.com>
 <CALte62zbV-3AgNAUdaoiJxJvphS1FbuFAoyEknQZhik60jVzPA@mail.gmail.com>
 <CAL8XnioGWJA=R-oZ87a_vADi6LayeEYF7U15uHjWKsfBbD69wA@mail.gmail.com>
 <CALte62xqoNWUfT572tG8X6NU6DfJEvBrZA+SYU++OSO=ETTnLQ@mail.gmail.com> <CAL8XniqqgnkQ=CiBSzpi9a6up=x8JJ0QPCU_HMFA+n4yrg5BfQ@mail.gmail.com>
From: Ted Yu <yuzhihong@gmail.com>
Date: Wed, 15 Jun 2016 07:26:42 -0700
Message-ID: <CALte62z7huRr-ywYcA3_8dj52D5RN00ozwREuWOwCuX_pmAtbA@mail.gmail.com>
Subject: Re: HBase acl commands are too slow
To: "user@hbase.apache.org" <user@hbase.apache.org>
Content-Type: multipart/alternative; boundary=001a114c6bde1e68e7053551e930
archived-at: Wed, 15 Jun 2016 14:26:52 -0000

--001a114c6bde1e68e7053551e930
Content-Type: text/plain; charset=UTF-8

Have you looked at http://hbase.apache.org/book.html#security ?

I noticed that DEBUG logging was not on in the log you posted earlier.
Is it possible to turn on DEBUG logging and repeat the operation ?

Thanks

On Wed, Jun 15, 2016 at 2:12 AM, kumar r <kumarccpp@gmail.com> wrote:

> Hi Ted,
>
> Thanks for your reply.
>
> I cannot find anything in configuration. Can you tell me what might be root
> cause for this issue?
>
> What will be major cause for acl command taking more than 30 seconds to
> process. I cannot find anything other than this in hbase log. Is there any
> documentation available to secure zookeeper and hbase with kerberos
> properly?
>
> The same log occurs in normal cluster also and i have enabled
> authorization. The same authorization command runs in 5 to 6 seconds.
>
> Thanks,
> Kumar
>
> On Tue, Jun 14, 2016 at 7:59 PM, Ted Yu <yuzhihong@gmail.com> wrote:
>
> > bq.  Opening socket connection to server machine2/192.168.60.3:2181.
> Will
> > not attempt to authenticate using SASL (unknown error)
> >
> > It seems connection to zookeeper might have some issue.
> > Can you double check configuration ?
> >
> > On Mon, Jun 13, 2016 at 11:56 PM, kumar r <kumarccpp@gmail.com> wrote:
> >
> > > Hi,
> > >
> > > Thanks for the reply.
> > >
> > > Please find the command and time took to process it,
> > >
> > >
> > >
> > >
> > >
> > > *hbase(main):006:0> grant 'Selva','RW','@default'0 row(s) in 11.8830
> > > secondshbase(main):007:0> revoke 'Selva','@default'0 row(s) in 32.4330
> > > seconds*
> > >
> > > Find my HBase log in below pastebin
> > >
> > > http://pastebin.com/MHMjhHuF
> > >
> > >
> > > Thanks,
> > >
> > > Kumar
> > >
> > >
> > > On Mon, Jun 13, 2016 at 7:42 PM, Ted Yu <yuzhihong@gmail.com> wrote:
> > >
> > > > Can you inspect master log for the corresponding 40 seconds to see if
> > > there
> > > > was some clue ?
> > > >
> > > > Feel free to pastebin the log snippet for this period if you cannot
> > > > determine the cause.
> > > >
> > > > Cheers
> > > >
> > > > On Sun, Jun 12, 2016 at 10:19 PM, kumar r <kumarccpp@gmail.com>
> wrote:
> > > >
> > > > > Hi,
> > > > >
> > > > > I have configured secure HBase-1.1.3. Hadoop version using 2.7.2.
> > > > >
> > > > > I have enabled authorization in HBase.
> > > > >
> > > > > When executing any authorization command like user_permission,
> grant,
> > > > > revoke,
> > > > > etc.
> > > > >
> > > > > Its getting more than 40 seconds to display the result.
> > > > >
> > > > > Below are hbase-site.xml configuration properties
> > > > >
> > > > >
> > > > > <property>
> > > > >     <name>hbase.master</name>
> > > > >     <value>IP:60000</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.rootdir</name>
> > > > >     <value>hdfs://IP:9000/HBase</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.cluster.distributed</name>
> > > > >     <value>true</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.zookeeper.quorum</name>
> > > > >     <value>IP1:2181,IP2:2181,IP3:2181</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.master.port</name>
> > > > >     <value>60000</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.master.info.port</name>
> > > > >     <value>60010</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.regionserver.port</name>
> > > > >     <value>60020</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.regionserver.info.port</name>
> > > > >     <value>60030</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.security.authentication</name>
> > > > >     <value>KERBEROS</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.master.keytab.file</name>
> > > > >     <value>masterkeytab</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.regionserver.keytab.file</name>
> > > > >     <value>regionserverkeytab</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.master.kerberos.principal</name>
> > > > >     <value>masterprincipal</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.regionserver.kerberos.principal</name>
> > > > >     <value>regionserverprincipal</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.rpc.engine</name>
> > > > >     <value>org.apache.hadoop.hbase.ipc.SecureRpcEngine</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.ssl.enabled</name>
> > > > >     <value>true</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.superuser</name>
> > > > >     <value>@HadoopUser</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.security.authorization</name>
> > > > >     <value>true</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.coprocessor.master.classes</name>
> > > > >
> > > >
> > <value>org.apache.hadoop.hbase.security.access.AccessController</value>
> > > > > </property>
> > > > > <property>
> > > > >     <name>hbase.coprocessor.region.classes</name>
> > > > >
> > > > >
> > > >
> > >
> >
> <value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
> > > > > </property>
> > > > >
> > > > > Find my stack overflow question here
> > > > >
> > > >
> > >
> >
> http://stackoverflow.com/questions/37782043/hbase-acl-commands-are-too-slow
> > > > >
> > > > > Thanks,
> > > > >
> > > > > Kumar
> > > > >
> > > >
> > >
> >
>

--001a114c6bde1e68e7053551e930--