Follow

How do I know if Analytics Succeeded or Failed?

Question

How do I know if Analytics has succeeded or failed? 

Summary

This document will provide a method to verify if Analytics has succeeded. Moreover, if Analytics has failed, this KB article will outline how to identify where the failure occurred and extract the relevant error  so that it can searched on Interset Knowledgebase for resolution steps, or alternatively, send the to Interset Support (support@interset.com)

The following nodes will need to be accessed (via web or SSH to the respective nodes):

  • AMBARI (web)
  • MASTER (ANALYTICS) (SSH) 

Steps

Check analytics.log

  1. SSH to the MASTER (ANALYTICS) NODE as the Interset User
  2. Type in the following to navigate to the Interset log (/opt/interset/log) directory:
    • cd /opt/interset/log
  3. In the log directory, there is an analytics.log which contains the Analytics spark jobs that are submitted to spark to execute. To verify whether or not analytics has completed successfully, type in the following command:
    • cat analytics.log | grep -B 3 -A 3 finished
  4. If the command above returns a value, then it means that Analytics has completed successfully.
  5. If the command above does not return a value,, type in the following command to view the analytics.log:
    • less analytics.log
  6. Look through the log and identify where the failure occurred. Normally, the error outputted will be a stack trace error. Please examine the error outputted and search the stack trace error with in the Interset Knowledgebase.
  7. If the stack trace error is not available in the Interset Knowledgebase, please continue to next section to investigate the YARN ResourceManagerUI.

For more information on the Analytics jobs, please see the section below.

Check YARN ResourceManagerUI

  1. Open up a web browser and navigate to the Ambari UI URL:
  2. Log in to the Ambari UI as the Ambari admin. The default credentials for the Ambari admin user are as follow:
    • Username: admin
    • Password: admin
  3. Once logged in, click on YARN (from components list)
  4. In YARN, click on Quick Links > ResourceManager UIScreen_Shot_2018-03-27_at_2.52.46_PM.png
  5. The ResourceManager UI lists all Analytics spark jobs that have been submitted to the cluster in chronological order as well as their current state and final status.
  6. Below is a list of jobs that constitute a complete analytics run (in order and by category):
    • Aggregation
      • com.interset.analytics.aggregation.EntityMappingJob
      • com.interset.analytics.scoring.BotClassifierJob
      • com.interset.analytics.aggregation.AggregateJob
    • Training
      • interset.analytics.training.EntityRelationStatsJob
      • interset.analytics.training.ClusteringJob
      • interset.analytics.aggregation.AggregateStatsJob
      • interset.analytics.training.WorkingDaysJob
      • interset.analytics.training.WorkingHoursJob
      • interset.analytics.training.HumanMachineClassifier
      • com.interset.analytics.training.UpdateTrainingPeriodJob
    • Scoring
      • interset.analytics.scoring.DirectAnomaliesJob
      • interset.analytics.scoring.AnomalyStatsJob
      • interset.analytics.scoring.WorkingDaysJob
      • interset.analytics.scoring.WorkingHoursJob
      • interset.analytics.scoring.GenerateAnomaliesJob
      • interset.analytics.scoring.HumanMachineClassifier
      • interset.analytics.scoring.AnomalousEntitiesJob
      • interset.analytics.scoring.AggregateStoryJob
      • com.interset.analytics.scoring.EntityVulnerabilityJob
    • Indexing
      • interset.analytics.indexing.EntityRelationStatsIndexerJob
      • interset.analytics.indexing.EntityStatsIndexerJob
      • interset.analytics.indexing.AnomaliesIndexerJob
      • interset.analytics.indexing.WorkingHoursIndexerJob
      • interset.analytics.indexing.RiskyEntitiesIndexerJob
      • interset.analytics.indexing.ReportingTagsIndexerJob
      • interset.analytics.indexing.RiskScoresIndexerJob
      • interset.analytics.indexing.EntityRelationCountsIndexerJob
      • interset.analytics.indexing.RelationTagsIndexerJob
      • com.interset.analytics.indexing.IndexingAliasAndCleanupJob
    • Total: 29 Jobs

If a spark job failed, please continue to the next section to investigate the cause of the failure.

Check for Analytics failure

  1. If a specific job fails, the ResourceManager UI will mark the State and FinalState as FAILED.
  2. In this instance, in the ResourceManager UI, click on FAILED, under the Cluster pane. This will filter only on FAILED jobs.Screen_Shot_2018-03-27_at_4.24.04_PM.png
  3. Note the FAILED job names under the Names column, as each job in the latest Analytics run should be investigated accordingly. Each job name are appended with batch/windowed and tenant ID.
    • EXAMPLE: com.interset.analytics.scoring.EntityVulnerabilityJob-batch-<myTID>
  4. To explore the logs for the FAILED job, In the ResourceManager UI that is filtered by FAILED jobs, click on the link in the ID column that corresponds to the FAILED job.Screen_Shot_2018-03-27_at_4.48.38_PM.png
  5. Scroll down to the bottom of the page, and a list of job attempts (Attempt ID column), along with node association are listed. Each attempt will have logs associated under the Logs column.
  6. To investigate further on why the jobs failed, one must click on the Logs link under the Logs column.Screen_Shot_2018-03-28_at_9.32.38_AM.png
    • NOTE: If more than one attempt is listed, please click the Logs link for the latest attempt.
  7. The Logs page aggregates different log types. With a failing job, the best place to start is looking at the stderr log.
  8. In the Logs page, scroll down and look for the following:
    • Log Type: stderr
  9. Three lines below, it will display Showing XXXX bytes of XXXX total. Click here for the full log. Click on the here link.Screen_Shot_2018-03-28_at_9.44.46_AM.png
  10. Scroll down in the stderr log until a stack trace error is thrown. Please examine the error outputted and search the stack trace error with in the Interset Knowledgebase.
  11. If no KBs are found, please contact Interset Support (support@interset.com).

Applies To

  • Interset 5.4.x or higher

 

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments