Spark jobs unable to process data after upgrading SSDM

  • 7018726
  • 23-Mar-2017
  • 29-Mar-2017


NetIQ Sentinel 8.0.1 SSDM


After upgrading SSDM 8.0.0 to 8.0.1 along with ElasticSearch 2.3.2 to 5.0, the spark jobs were unable to process data.  The new events are getting processed in Spark job streaming tab, but are not able to get stored to SOR and indexed to ES


To workaround the issue and prevent any possible data loss upgrade using the following procedure. 

1. open the Sentinel web interface and go to storage | scalable storage 

Note: Make note of the current Kafka port being used.  

2. Change the Kafka port number to something else and save

Note: The will temporarily cause incoming data to be cached on the CM (collector manager). 

3. Upgrade per SSDM upgrade instructions in the Sentinel install guide. 

4. Change the Kafka port back to the original port number


This is a known issue found in the spark forums.