Zhao, Qingwen created EAGLE-48:
----------------------------------
Summary: Alert message time is wrong in some cases
Key: EAGLE-48
URL: https://issues.apache.org/jira/browse/EAGLE-48
Project: Eagle
Issue Type: Bug
Environment: hortonworrks sandbox
Reporter: Zhao, Qingwen
Today I test HDFS security log topology, and create a policy “hdfs security"
from hdfsSecurityLogEventStream[(allowed == false) and (user ==
'hbase')]#window.externalTime(timestamp,10 min) select user, count(timestamp)
as aggValue group by user having aggValue >= 2 insert into outputStream;
And found the alert message time is always 1970-01-01 00:00:00[UTC]. The
importing log is
2015-11-18 08:41:10,200 INFO
SecurityLogger.org.apache.hadoop.security.authorize.ServiceAuthorizationManager:
Authorization failed for hbase (auth:SIMPLE) for protocol=interface
org.apache.hadoop.hdfs.protocol.ClientProtocol
Check the parsing code, found no problem. Then I create another testing policy
“testAnother"
from hdfsSecurityLogEventStream[(allowed == false) and (user == 'hbase')]
select * insert into outputStream;
This time the message time is OK.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
