[HDFS-12070] Failed block recovery leaves files open indefinitely and at risk for data loss

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0-alpha
• Fix Version/s: 3.1.0, 2.10.0, 2.9.1, 2.8.4, 3.0.3
• Target Version/s: 2.8.3
• Hadoop Flags: Reviewed
• Assignee: Kihwal Lee
• Reporter: Daryn Sharp
• Created: 29/Jun/17 17:13
• Updated: 12/Aug/23 04:39
• Resolved: 26/Feb/18 17:19

Description

Files will remain open indefinitely if block recovery fails which creates a high risk of data loss. The replication monitor will not replicate these blocks.

The NN provides the primary node a list of candidate nodes for recovery which involves a 2-stage process. The primary node removes any candidates that cannot init replica recovery (essentially alive and knows about the block) to create a sync list. Stage 2 issues updates to the sync list – but fails if any node fails unlike the first stage. The NN should be informed of nodes that did succeed.

Manual recovery will also fail until the problematic node is temporarily stopped so a connection refused will induce the bad node to be pruned from the candidates. Recovery succeeds, the lease is released, under replication is fixed, and block is invalidated from the bad node.

Issue Links

• relates to: HDFS-17157 Transient network failure in lease recovery could be mitigated to ensure better consistency