Follow

There is no new data showing up in the Reporting UI

Issue

When logging in to the Reporting UI, there is no new data presented in the Overall Risk score

Cause

This is generally caused by no new data being ingested since previous Analytics run.

For more information on when and where Analytics start, please see the “When and where does Analytics start” KB article

Resolution Steps

There are several steps to take and validate to ensure:

  • Analytics ran successfully
  • Up to date data is pushed to HBase 

Check last Analytics run time

  1. Open up a web browser and navigate to the Ambari UI URL:
    • EXAMPLE: http://ambari.acme.com:8080
  2. Log in to the Ambari UI as the Ambari admin. The default credentials for the Ambari admin user are as follow:
    • Username: admin
    • Password: password
  3. Once logged in, click on YARN (from components list)
  4. In YARN, click on Quick Links > ResourceManager UI
  5. Take a look at the latest Analytics run to ensure all jobs completed successfully. Below is a list of jobs that constitute a complete analytics run in their respective category:
    • Aggregation
      • com.interset.analytics.aggregation.EntityMappingJob
      • com.interset.analytics.scoring.BotClassifierJob
      • com.interset.analytics.aggregation.AggregateJob
    • Training
      • interset.analytics.training.EntityRelationStatsJob
      • interset.analytics.training.ClusteringJob
      • interset.analytics.aggregation.AggregateStatsJob
      • interset.analytics.training.WorkingDaysJob
      • interset.analytics.training.WorkingHoursJob
      • interset.analytics.training.HumanMachineClassifier
      • com.interset.analytics.training.UpdateTrainingPeriodJob
    • Scoring
      • interset.analytics.scoring.DirectAnomaliesJob
      • interset.analytics.scoring.AnomalyStatsJob
      • interset.analytics.scoring.WorkingDaysJob
      • interset.analytics.scoring.WorkingHoursJob
      • interset.analytics.scoring.GenerateAnomaliesJob
      • interset.analytics.scoring.HumanMachineClassifier
      • interset.analytics.scoring.AnomalousEntitiesJob
      • interset.analytics.scoring.AggregateStoryJob
      • com.interset.analytics.scoring.EntityVulnerabilityJob
    • Indexing
      • interset.analytics.indexing.EntityRelationStatsIndexerJob
      • interset.analytics.indexing.EntityStatsIndexerJob
      • interset.analytics.indexing.AnomaliesIndexerJob
      • interset.analytics.indexing.WorkingHoursIndexerJob
      • interset.analytics.indexing.RiskyEntitiesIndexerJob
      • interset.analytics.indexing.ReportingTagsIndexerJob
      • interset.analytics.indexing.RiskScoresIndexerJob
      • interset.analytics.indexing.EntityRelationCountsIndexerJob
      • interset.analytics.indexing.RelationTagsIndexerJob
      • com.interset.analytics.indexing.IndexingAliasAndCleanupJob
    • [Total: 29 Jobs]

Check HBase

  1. SSH to the MASTER NODE as the Interset User.
  2. Type in the following command to launch the Phoenix SQL console:
    • phoenix-sqlline
  3. Type in the following command list the minimum and maximum timestamp that has been ingested into HBase:
    • SELECT MIN(DATEMINUTE), MAX(DATEMINUTE) FROM OBSERVED_ENTITY_RELATION_MINUTELY_COUNTS WHERE TID = '0' AND DATEMINUTE > TO_DATE('0', 'S');
  4. The output will be similar to the following:
    MIN(DATEMINUTE) MAX(DATEMINUTE)
    2016-04-01 13:00:00.000 2016-05-30 22:58:00.000
  5. If the MAX(DATEMINUTE) date output is less than the date shown in the Reporting UI Overall Risk Page, this may be an indication that there is no new data to ingest, or there is an issue with the data ingestion configuration. For more information, please see the “My data ingest is failing” KB article

Applies To

  • Interset 5.4.x or higher
Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments