suvodeep-pyne commented on code in PR #20076:
URL: https://github.com/apache/pinot/pull/20076#discussion_r4407597084
##########
pinot-core/src/main/java/org/apache/pinot/core/data/manager/realtime/RealtimeSegmentDataManager.java:
##########
@@ -664,6 +674,8 @@ private boolean processStreamEvents(MessageBatch
messageBatch, long idlePipeSlee
StreamPartitionMsgOffset nextOffset = metadata.getNextOffset();
int rowSizeInBytes = metadata.getRecordSerializedSize();
if (decodedRow.getException() != null) {
+ // A failed schema-registry lookup drops the row, so every failed row
is classified and written at once.
+ recordSourceError("decode", decodedRow.getException(), true);
Review Comment:
Thanks for measuring. I would keep per-row recording for now:
- A row that fails decode is dropped, so the cost falls only on rows Pinot
discards. With file logging, this path is still 8–12× faster than master.
- A plain once-a-second throttle would miss a refusal that follows an
unclassified failure in the same second: a malformed row, then a registry 403
in the same batch. `registryRefusalDuringDecodeIsRecordedWhileFetchesSucceed`
covers that case.
If the owners want this cost removed, the throttle should start only after a
write: once this segment writes a gauge, skip classification for one second.
That takes the lock out of a 403 storm and keeps the mixed case. I can add it.
##########
pinot-core/src/main/java/org/apache/pinot/core/data/manager/realtime/IngestionSourceErrorRecorder.java:
##########
@@ -0,0 +1,126 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.pinot.core.data.manager.realtime;
+
+import java.util.Collection;
+import java.util.EnumMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.TimeUnit;
+import org.apache.pinot.common.metrics.ServerGauge;
+import org.apache.pinot.common.metrics.ServerMetrics;
+import org.apache.pinot.spi.ingestion.error.IngestionSourceErrorCategory;
+import org.apache.pinot.spi.ingestion.error.IngestionSourceErrorClassification;
+import org.apache.pinot.spi.ingestion.error.IngestionSourceErrorClassifier;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+/// Records the stream source failures a realtime table's consumers and its
ingestion delay tracker see: a timestamp
+/// gauge per partition and category, and a WARN line per write, rate-limited
per category.
+///
+/// [IngestionSourceErrorCategory#AUTH] is written at every refusal, whether
or not Pinot retries.
+/// [IngestionSourceErrorCategory#SOURCE_READ] is written only once Pinot
gives up on the source, so a transient
+/// failure it recovers from writes nothing. The gauges record when a failure
last happened: they are never cleared on
+/// success or when a partition stops consuming, only when the table data
manager shuts down ([#close]).
Review Comment:
Intended for CONSUMING→OFFLINE, but not for a partition that moves away.
- A failure that ends consumption makes the controller mark the segment
OFFLINE (`segmentStoppedConsuming`), and `onConsumingToOffline` drops the delay
tracker's partition gauges at that point. If the source gauges followed them,
the signal would disappear when it is needed. So they outlive that transition.
- You are right about a partition that moves to another server: its series
stays until restart. The value stays true ("this server last saw a failure at
T"), so a freshness alert or a max by table still reads correctly. The extra
series are at most two per partition that had a failure on this server.
- If the owners prefer, I can remove a partition's source gauges on
CONSUMING→DROPPED, and when the tracker finds that the partition is no longer
hosted, and keep them through OFFLINE.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
