insight

Describes the maprcli command to enable insights and get information related to insights.

Syntax

The insight command is used to manage the retrieval and pushing of audit log data by the insight service. The insight service retrieves and pushes audit log data related to MFS, CLDB, auth, and S3 services to Apache Iceberg tables. The data in the Apache Iceberg tables can be used for analysis related to anomalies in user behavior, such as authentication, authorization, file operations. Audit log data related to the individual services, MFS, CLDB, auth and S3, can be selectively pushed to Apache Iceberg tables.

Other operations related to insight data such as listing and specifying the retention period can be performed by using the insight command.

 
insight
 
        cluster
                [ -enable set true/false ]
                [ -nodes node names space separated  ]
                [ -type audit type [mfs, s3, auth, cldb]  ]
 
        info
                [ -nodes node names space separated  ]
                [ -type audit type [mfs, s3, auth, cldb]  ]
                [ -purge true/false ]
                [ -dashboard to list dashboard query; supports -id option; Parameter takes no value  ]
                [ -summary-table list or display status of summary tables; supports -id and -verbose options; Parameter takes no value  ]
                [ -id <n>. Use with -summary-table or -dashboard only ]
                [ -verbose true/false. Use with -summary-table only ]
 
        purge
                 -retentionDays set retention days
 
        dashboard
                [ -enable true/false dashboard query(ies) ]
                [ -id dashboard query identifier <n> ]
                [ -configure to configure zeppelin notebook on the given ip/hostname; supports -zeppelin, -jsessionid options; Parameter takes no value  ]
                [ -run run zeppelin notebook; supports -zeppelin, -jsessionid, -notebook, -queryid, logparastatus options; Parameter takes no value  ]
                [ -zeppelin <ip/hostname> to configure, can be used with -run or -configure only ]
                [ -jsessionid dashboard jsession id <n> needs to be used with -run or -configure only ]
                [ -logparastatus logs the paragraph result. Use with -run only Parameter takes no value  ]
                [ -notebook notebook path. Use with -run only ]
                [ -queryid dashboard query id. Use with -run only ]

See the individual subcommand help for details related to each subcommand.

TIP
Following are the parameters related to insights service that can be configured using the config save maprcli command.
  • cldb.insight.buffer.size
  • cldb.insight.commit.interval.mins
  • cldb.insight.debug.enabled
  • cldb.insight.heartbeat.seconds
  • cldb.insight.hivemetastore.sasl.enabled
  • cldb.insight.hivemetastore.ssl.enabled
  • cldb.insight.hms.host.fetch.seconds
  • cldb.insight.purge.frequency.hours
  • cldb.insight.summarization.minutes
  • cldb.insight.summarytable.purge.hours
  • cldb.insight.threshold.heartbeats
  • cldb.insight.zeppelin.port
  • dfui.insight.enable

You can view the values for the insight-related parameters by using the config load maprcli command. For example:

                                   
# maprcli config load -json | grep insight
                        "cldb.insight.buffer.size":"1024",
                        "cldb.insight.commit.interval.mins":"1",
                        "cldb.insight.debug.enabled":"0",
                        "cldb.insight.heartbeat.seconds":"5",
                        "cldb.insight.hivemetastore.sasl.enabled":"1",
                        "cldb.insight.hivemetastore.ssl.enabled":"0",
                        "cldb.insight.hms.host.fetch.seconds":"60",
                        "cldb.insight.purge.frequency.hours":"1",
                        "cldb.insight.summarization.minutes":"5",
                        "cldb.insight.summarytable.purge.hours":"1",
                        "cldb.insight.threshold.heartbeats":"5",
                        "cldb.insight.zeppelin.port":"9995",
                        "dfui.insight.enable":"0",