Tim Armstrong created IMPALA-8838:
-------------------------------------

             Summary: Impala wrote audit log with missing statement_type
                 Key: IMPALA-8838
                 URL: https://issues.apache.org/jira/browse/IMPALA-8838
             Project: IMPALA
          Issue Type: Bug
    Affects Versions: Impala 2.9.0
            Reporter: Tim Armstrong


We saw an audit log with a missing statement_type, where it should have been 
QUERY. Filing a bug to see if this reoccurs and if there is a pattern to it (we 
don't have a way to reproduce or debug now).

{noformat}
{
  "serviceType": "IMPALA", 
  "serviceName": "impala", 
  "extraValues": {
    "12345678912345": {
      "status": "", 
      "impersonator": null, 
      "start_time": "2019-01-01 00:00:00.000000000", 
      "network_address": "123.123.123.123:12345", 
      "authorization_failure": false, 
      "sql_statement": "SELECT NDV_NO_FINALIZE(col) AS col, CAST(-1 as BIGINT), 
8, CAST(8 as DOUBLE), COUNT(col), ... FROM table WHERE (day='2019-01-01') GROUP 
BY day",
      "session_id\\ ": "xxxxxxxxxxxxxx:xxxxxxxxxxxxxx", 
      "query_id": "xxxxxxxxxxxxxxx:xxxxxxxxxxxxxx", 
      "catalog_objects": [
        {
          "privilege": "VIEW_METADATA", 
          "object_type": "", 
          "name": "_impala_builtins"
        }, 
        {
          "privilege": "SELECT", 
          " object_type": "", 
          "name": "table"
        }
      ], 
      "statement_type": "", 
      "user": "u...@realm.net"
    }
  }
}
{noformat}

statement_type is printed here:
https://github.com/cloudera/Impala/blob/cdh5-2.9.0_5.12.2/be/src/service/impala-server.cc#L474

It calls out to the function which prints an enum 
here:https://github.com/cloudera/Impala/blob/cdh5-2.9.0_5.12.2/be/src/util/debug-util.cc#L68.
 The only way it can produce an empty string is if the enum value is 
out-of-range, which shouldn't be possible unless we're reading an uninitialised 
value or the memory is somehow corrupted. However, all the surrounding fields 
in the TExecRequest object look like they were written out to the audit log OK

The code has changed a bit in master because of the thrift version upgrade, but 
it is still equivalent as far as I can see.




--
This message was sent by Atlassian JIRA
(v7.6.14#76016)

Reply via email to