Splunk UBA安装时执行Caspida setuphadoop报错求助

报错详情 #

IP - 192.168.126.16
Fri Jun 2 17:06:10 +07 2023: Running: /opt/caspida/bin/Caspida setuphadoop
...............................Failed to run sudo -u hdfs hdfs namenode -format >> /var/vcap/sys/log/caspida/caspida.out 2>&1
Fri Jun 2 17:06:11 +07 2023: [ERROR] Failed to run hadoop_setup [2]. Fix errors and re-run again.
Error in running /opt/caspida/bin/Caspida setuphadoop on 192.168.126.16. Fix errors and re-run again.

排查步骤 #

• 检查hdfs用户有效性：执行id hdfs确认系统中存在该用户；同时确保hdfs用户对Hadoop namenode存储目录、/var/vcap/sys/log/caspida/目录拥有读写权限
• 查看详细错误日志：直接读取/var/vcap/sys/log/caspida/caspida.out文件，里面包含hdfs namenode -format命令执行失败的具体原因（如目录已格式化、磁盘空间不足、权限拒绝等）
• 手动执行命令定位问题：以root身份执行sudo -u hdfs hdfs namenode -format，观察实时输出的错误信息，快速定位核心问题
• 验证Hadoop配置文件：检查/opt/caspida/conf/hadoop/下的core-site.xml、hdfs-site.xml，确认namenode存储路径配置正确，且路径未被占用、未提前格式化
• 检查磁盘状态：确认namenode存储目录所在磁盘有足够剩余空间，且磁盘未处于只读挂载状态

内容的提问来源于stack exchange，提问作者Tuấn Phạm Quang