Spark jobs unable to process data after upgrading SSDM

  • 7018726
  • 23-Mar-2017
  • 29-Mar-2017

Environment

NetIQ Sentinel 8.0.1 SSDM

Situation

After upgrading SSDM 8.0.0 to 8.0.1 along with ElasticSearch 2.3.2 to 5.0, the spark jobs were unable to process data.  The new events are getting processed in Spark job streaming tab, but are not able to get stored to SOR and indexed to ES

Resolution

To workaround the issue and prevent any possible data loss upgrade using the following procedure. 

1. open the Sentinel web interface and go to storage | scalable storage 

Note: Make note of the current Kafka port being used.  

2. Change the Kafka port number to something else and save

Note: The will temporarily cause incoming data to be cached on the CM (collector manager). 

3. Upgrade per SSDM upgrade instructions in the Sentinel install guide. 

4. Change the Kafka port back to the original port number

Cause

This is a known issue found in the spark forums. https://spark.apache.org/docs/1.5.1/streaming-programming-guide.html#upgrading-application-code