Uploaded image for project: 'Hadoop YARN'
  1. Hadoop YARN
  2. YARN-3834

Scrub debug logging of tokens during resource localization.

    Details

    • Type: Improvement
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.7.1
    • Fix Version/s: 2.8.0, 3.0.0-alpha1
    • Component/s: nodemanager
    • Labels:
      None
    • Target Version/s:

      Description

      During resource localization, the NodeManager logs tokens at debug level to aid troubleshooting. This includes the full token representation. Best practice is to avoid logging anything secret, even at debug level. We can improve on this by changing the logging to use a scrubbed representation of the token.

        Activity

        Hide
        cnauroth Chris Nauroth added a comment -

        The attached patch changes the code to use Token#toString. The toString method is already coded to be safe for logging, because it does not include any representation of the secret. Thanks also to Luke Lu for the suggestion to add logging of a fingerprint of the full representation, which is a one-way hash (non-reversible, therefore safe).

        Show
        cnauroth Chris Nauroth added a comment - The attached patch changes the code to use Token#toString . The toString method is already coded to be safe for logging, because it does not include any representation of the secret. Thanks also to Luke Lu for the suggestion to add logging of a fingerprint of the full representation, which is a one-way hash (non-reversible, therefore safe).
        Hide
        hadoopqa Hadoop QA added a comment -



        +1 overall



        Vote Subsystem Runtime Comment
        0 pre-patch 16m 3s Pre-patch trunk compilation is healthy.
        +1 @author 0m 0s The patch does not contain any @author tags.
        +1 tests included 0m 0s The patch appears to include 1 new or modified test files.
        +1 javac 7m 38s There were no new javac warning messages.
        +1 javadoc 9m 38s There were no new javadoc warning messages.
        +1 release audit 0m 23s The applied patch does not increase the total number of release audit warnings.
        +1 checkstyle 0m 36s There were no new checkstyle issues.
        +1 whitespace 0m 0s The patch has no lines that end in whitespace.
        +1 install 1m 33s mvn install still works.
        +1 eclipse:eclipse 0m 33s The patch built with eclipse:eclipse.
        +1 findbugs 1m 12s The patch does not introduce any new Findbugs (version 3.0.0) warnings.
        +1 yarn tests 6m 16s Tests passed in hadoop-yarn-server-nodemanager.
            43m 55s  



        Subsystem Report/Notes
        Patch URL http://issues.apache.org/jira/secure/attachment/12740692/YARN-3834.001.patch
        Optional Tests javadoc javac unit findbugs checkstyle
        git revision trunk / 49f5d20
        hadoop-yarn-server-nodemanager test log https://builds.apache.org/job/PreCommit-YARN-Build/8294/artifact/patchprocess/testrun_hadoop-yarn-server-nodemanager.txt
        Test Results https://builds.apache.org/job/PreCommit-YARN-Build/8294/testReport/
        Java 1.7.0_55
        uname Linux asf904.gq1.ygridcore.net 3.13.0-36-lowlatency #63-Ubuntu SMP PREEMPT Wed Sep 3 21:56:12 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
        Console output https://builds.apache.org/job/PreCommit-YARN-Build/8294/console

        This message was automatically generated.

        Show
        hadoopqa Hadoop QA added a comment - +1 overall Vote Subsystem Runtime Comment 0 pre-patch 16m 3s Pre-patch trunk compilation is healthy. +1 @author 0m 0s The patch does not contain any @author tags. +1 tests included 0m 0s The patch appears to include 1 new or modified test files. +1 javac 7m 38s There were no new javac warning messages. +1 javadoc 9m 38s There were no new javadoc warning messages. +1 release audit 0m 23s The applied patch does not increase the total number of release audit warnings. +1 checkstyle 0m 36s There were no new checkstyle issues. +1 whitespace 0m 0s The patch has no lines that end in whitespace. +1 install 1m 33s mvn install still works. +1 eclipse:eclipse 0m 33s The patch built with eclipse:eclipse. +1 findbugs 1m 12s The patch does not introduce any new Findbugs (version 3.0.0) warnings. +1 yarn tests 6m 16s Tests passed in hadoop-yarn-server-nodemanager.     43m 55s   Subsystem Report/Notes Patch URL http://issues.apache.org/jira/secure/attachment/12740692/YARN-3834.001.patch Optional Tests javadoc javac unit findbugs checkstyle git revision trunk / 49f5d20 hadoop-yarn-server-nodemanager test log https://builds.apache.org/job/PreCommit-YARN-Build/8294/artifact/patchprocess/testrun_hadoop-yarn-server-nodemanager.txt Test Results https://builds.apache.org/job/PreCommit-YARN-Build/8294/testReport/ Java 1.7.0_55 uname Linux asf904.gq1.ygridcore.net 3.13.0-36-lowlatency #63-Ubuntu SMP PREEMPT Wed Sep 3 21:56:12 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux Console output https://builds.apache.org/job/PreCommit-YARN-Build/8294/console This message was automatically generated.
        Hide
        xgong Xuan Gong added a comment -

        +1 LGTM. Will commit

        Show
        xgong Xuan Gong added a comment - +1 LGTM. Will commit
        Hide
        xgong Xuan Gong added a comment -

        Committed into trunk/branch-2. Thanks, Chris

        Show
        xgong Xuan Gong added a comment - Committed into trunk/branch-2. Thanks, Chris
        Hide
        hudson Hudson added a comment -

        FAILURE: Integrated in Hadoop-trunk-Commit #8043 (See https://builds.apache.org/job/Hadoop-trunk-Commit/8043/)
        YARN-3834. Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e)

        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java
        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java
        • hadoop-yarn-project/CHANGES.txt
        Show
        hudson Hudson added a comment - FAILURE: Integrated in Hadoop-trunk-Commit #8043 (See https://builds.apache.org/job/Hadoop-trunk-Commit/8043/ ) YARN-3834 . Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e) hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java hadoop-yarn-project/CHANGES.txt
        Hide
        cnauroth Chris Nauroth added a comment -

        Xuan, thank you for the code review and commit.

        Show
        cnauroth Chris Nauroth added a comment - Xuan, thank you for the code review and commit.
        Hide
        hudson Hudson added a comment -

        FAILURE: Integrated in Hadoop-Yarn-trunk-Java8 #236 (See https://builds.apache.org/job/Hadoop-Yarn-trunk-Java8/236/)
        YARN-3834. Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e)

        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java
        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java
        • hadoop-yarn-project/CHANGES.txt
        Show
        hudson Hudson added a comment - FAILURE: Integrated in Hadoop-Yarn-trunk-Java8 #236 (See https://builds.apache.org/job/Hadoop-Yarn-trunk-Java8/236/ ) YARN-3834 . Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e) hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java hadoop-yarn-project/CHANGES.txt
        Hide
        hudson Hudson added a comment -

        FAILURE: Integrated in Hadoop-Yarn-trunk #966 (See https://builds.apache.org/job/Hadoop-Yarn-trunk/966/)
        YARN-3834. Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e)

        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java
        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java
        • hadoop-yarn-project/CHANGES.txt
        Show
        hudson Hudson added a comment - FAILURE: Integrated in Hadoop-Yarn-trunk #966 (See https://builds.apache.org/job/Hadoop-Yarn-trunk/966/ ) YARN-3834 . Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e) hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java hadoop-yarn-project/CHANGES.txt
        Hide
        hudson Hudson added a comment -

        FAILURE: Integrated in Hadoop-Hdfs-trunk #2164 (See https://builds.apache.org/job/Hadoop-Hdfs-trunk/2164/)
        YARN-3834. Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e)

        • hadoop-yarn-project/CHANGES.txt
        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java
        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java
        Show
        hudson Hudson added a comment - FAILURE: Integrated in Hadoop-Hdfs-trunk #2164 (See https://builds.apache.org/job/Hadoop-Hdfs-trunk/2164/ ) YARN-3834 . Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e) hadoop-yarn-project/CHANGES.txt hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java
        Hide
        hudson Hudson added a comment -

        FAILURE: Integrated in Hadoop-Hdfs-trunk-Java8 #225 (See https://builds.apache.org/job/Hadoop-Hdfs-trunk-Java8/225/)
        YARN-3834. Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e)

        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java
        • hadoop-yarn-project/CHANGES.txt
        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java
        Show
        hudson Hudson added a comment - FAILURE: Integrated in Hadoop-Hdfs-trunk-Java8 #225 (See https://builds.apache.org/job/Hadoop-Hdfs-trunk-Java8/225/ ) YARN-3834 . Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e) hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java hadoop-yarn-project/CHANGES.txt hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java
        Hide
        hudson Hudson added a comment -

        FAILURE: Integrated in Hadoop-Mapreduce-trunk-Java8 #234 (See https://builds.apache.org/job/Hadoop-Mapreduce-trunk-Java8/234/)
        YARN-3834. Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e)

        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java
        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java
        • hadoop-yarn-project/CHANGES.txt
        Show
        hudson Hudson added a comment - FAILURE: Integrated in Hadoop-Mapreduce-trunk-Java8 #234 (See https://builds.apache.org/job/Hadoop-Mapreduce-trunk-Java8/234/ ) YARN-3834 . Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e) hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java hadoop-yarn-project/CHANGES.txt
        Hide
        hudson Hudson added a comment -

        FAILURE: Integrated in Hadoop-Mapreduce-trunk #2182 (See https://builds.apache.org/job/Hadoop-Mapreduce-trunk/2182/)
        YARN-3834. Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e)

        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java
        • hadoop-yarn-project/CHANGES.txt
        • hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java
        Show
        hudson Hudson added a comment - FAILURE: Integrated in Hadoop-Mapreduce-trunk #2182 (See https://builds.apache.org/job/Hadoop-Mapreduce-trunk/2182/ ) YARN-3834 . Scrub debug logging of tokens during resource localization. Contributed by Chris Nauroth (xgong: rev 6c7a9d502a633b5aca75c9798f19ce4a5729014e) hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/ResourceLocalizationService.java hadoop-yarn-project/CHANGES.txt hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/localizer/TestResourceLocalizationService.java

          People

          • Assignee:
            cnauroth Chris Nauroth
            Reporter:
            cnauroth Chris Nauroth
          • Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development