[
https://issues.apache.org/jira/browse/MAPREDUCE-4034?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13233129#comment-13233129
]
Jason Lowe commented on MAPREDUCE-4034:
---------------------------------------
Thanks to Siddarth Seth for the analysis on this issue. He discovered that the
RM is not filling out the application ACLs on the response to
ApplicationMasterService.registerApplicationMaster. The RM is responsible for
setting up the app ACLs on the node that runs the AM container, but the ACLs
for all the tasks are set via container requests from the AM. Since the AM
doesn't know the proper ACLs, any node *other* than the node the AM is running
on will have no ACLs for the app and the corresponding task logs will be
recorded without ACLs. When the history server tries to serve up these logs,
the lack of ACLs causes it to fall back to the default and only allows access
from the app owner and admins.
Logs for tasks that ran on the same node as the AM work since the node had the
proper ACLs setup by the RM. This explains why it was never seen on a
single-node cluster and why some tasks can be seen and others can't for the
same application.
Thanks again to Siddarth!
> Unable to view task logs on history server with mapreduce.job.acl-view-job=*
> ----------------------------------------------------------------------------
>
> Key: MAPREDUCE-4034
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-4034
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: mrv2
> Affects Versions: 0.23.2
> Reporter: Jason Lowe
> Assignee: Jason Lowe
> Priority: Blocker
>
> With log aggregation enabled, users other than the app owner or admins are
> sometimes unable to view the task logs on the history server even though they
> are in the ACL for the app. The same users are able to see the configuration
> and counters. Sometimes the users can see some task logs but not other task
> logs for the same application.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
