About jrtuck

Ran a new file this morning and received the same error.  The "1580390733_traffic_files.csv" is empty as you stated it would be.    ---- CREATING SPARK Session: warehouseLocation:/data/spark-warehouse +--------+--------+-------+----+------------+ |fwSerial|panosver|csvpath|size|afterProcess| +--------+--------+-------+----+------------+ +--------+--------+-------+----+------------+ Memory: 5838m LogCollector&Compacter called with the following parameters: Parameters for execution Master[processes]:............ local[3] Available RAM (MB):........... 5978112 User:......................... admin debug:........................ false Parameters for Job Connections Task ID:...................... 2162 My IP:........................ 10.170.1.35 Expedition IP:................ 10.170.1.35:3306 Time Zone:.................... Europe/Helsinki dbUser (dbPassword):.......... root (************) projectName:.................. demo Parameters for Data Sources App Categories (source):........ (Expedition) CSV Files Path:................./tmp/1580390733_traffic_files.csv Parquet output path:.......... file:///data/connections.parquet Temporary folder:............. /data ---- AppID DB LOAD: Application Categories loading... Application Categories loaded Exception in thread "main" java.util.NoSuchElementException: next on empty iterator at scala.collection.Iterator$$anon$2.next(Iterator.scala:39) at scala.collection.Iterator$$anon$2.next(Iterator.scala:37) at scala.collection.IndexedSeqLike$Elements.next(IndexedSeqLike.scala:63) at scala.collection.IterableLike$class.head(IterableLike.scala:107) at scala.collection.mutable.ArrayOps$ofInt.scala$collection$IndexedSeqOptimized$$super$head(ArrayOps.scala:234) at scala.collection.IndexedSeqOptimized$class.head(IndexedSeqOptimized.scala:126) at scala.collection.mutable.ArrayOps$ofInt.head(ArrayOps.scala:234) at com.paloaltonetworks.tbd.LogCollectorCompacter$.main(LogCollectorCompacter.scala:441) at com.paloaltonetworks.tbd.LogCollectorCompacter.main(LogCollectorCompacter.scala) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.spark.deploy.JavaMainApplication.start(SparkApplication.scala:52) at org.apache.spark.deploy.SparkSubmit.org$apache$spark$deploy$SparkSubmit$$runMain(SparkSubmit.scala:849) at org.apache.spark.deploy.SparkSubmit.doRunMain$1(SparkSubmit.scala:167) at org.apache.spark.deploy.SparkSubmit.submit(SparkSubmit.scala:195) at org.apache.spark.deploy.SparkSubmit.doSubmit(SparkSubmit.scala:86) at org.apache.spark.deploy.SparkSubmit$$anon$2.doSubmit(SparkSubmit.scala:924) at org.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:933) at org.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala) ubuntu@ip-10-170-1-35:/tmp$   ubuntu@ip-10-170-1-35:/tmp$ more 1580390733_traffic_files.csv fwSerial,panosver,csvpath,size,afterProcess / ubuntu@ip-10-170-1-35:/tmp$ ... View more

Yes, I am running version 1.1.53.     ... View more

That is good the weird message is expected behavior!  I do have the /tmp/error_logCoCo and the contents of that file is below.  In addition, we are running PAN-OS 9.04 on the firewalls, so I am not sure if Expedition can read the CSV files from that version of code.  However, I am running the latest version of Expedition.         ubuntu@ip-10-170-1-35:/tmp$ more error_logCoCo SLF4J: Class path contains multiple SLF4J bindings. SLF4J: Found binding in [jar:file:/opt/Spark/extraLibraries/slf4j-nop-1.7.25.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: Found binding in [jar:file:/opt/Spark/spark-2.4.3-bin-hadoop2.7/jars/slf4j-log4j12-1.7.16.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation. SLF4J: Actual binding is of type [org.slf4j.helpers.NOPLoggerFactory] ---- CREATING SPARK Session: warehouseLocation:/data/spark-warehouse +------------+--------+--------------------+----+------------+ | fwSerial|panosver| csvpath|size|afterProcess| +------------+--------+--------------------+----+------------+ |012001008166| 9.0.0|/home/expedition/...| 972| null| +------------+--------+--------------------+----+------------+ Memory: 5838m LogCollector&Compacter called with the following parameters: Parameters for execution Master[processes]:............ local[3] Available RAM (MB):........... 5978112 User:......................... admin debug:........................ false Parameters for Job Connections Task ID:...................... 2152 My IP:........................ 10.170.1.35 Expedition IP:................ 10.170.1.35:3306 Time Zone:.................... Europe/Helsinki dbUser (dbPassword):.......... root (************) projectName:.................. demo Parameters for Data Sources App Categories (source):........ (Expedition) CSV Files Path:................./tmp/1580321790_traffic_files.csv Parquet output path:.......... file:///data/connections.parquet Temporary folder:............. /data ---- AppID DB LOAD: Application Categories loading... Application Categories loaded +------------+--------+--------------------+----+------------+--------+---+---------------+ | fwSerial|panosver| csvpath|size|afterProcess| grouped|row|accumulatedSize| +------------+--------+--------------------+----+------------+--------+---+---------------+ |012001008166| 9.0.0|/home/expedition/...| 972| null|grouping| 1| 972.0| +------------+--------+--------------------+----+------------+--------+---+---------------+ Selection criteria: 0 < accumulatedSize and accumulatedSize <= 5978112 Processing from lowLimit:0 to highLimit:5978112 with StepLine:5978112 Few logs can fit in this batch:1 9.0.0:/home/expedition/logs/ivc-ind-mdf1-fw1_traffic_2020_01_29_last_calendar_day.csv Logs of format 7.1.x NOT found Logs of format 8.0.2 NOT found Logs of format 8.1.0-beta17 NOT found Logs of format 8.1.0 NOT found Logs of format 9.0.0 found Logs of format 9.1.0-beta NOT found SLF4J: Class path contains multiple SLF4J bindings. SLF4J: Found binding in [jar:file:/opt/Spark/extraLibraries/slf4j-nop-1.7.25.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: Found binding in [jar:file:/opt/Spark/spark-2.4.3-bin-hadoop2.7/jars/slf4j-log4j12-1.7.16.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation. SLF4J: Actual binding is of type [org.slf4j.helpers.NOPLoggerFactory] ---- CREATING SPARK Session: warehouseLocation:/data/spark-warehouse One loop done +--------+--------+-------+----+------------+ |fwSerial|panosver|csvpath|size|afterProcess| +--------+--------+-------+----+------------+ +--------+--------+-------+----+------------+ Memory: 5838m LogCollector&Compacter called with the following parameters: Parameters for execution Master[processes]:............ local[3] Available RAM (MB):........... 5978112 User:......................... admin debug:........................ false Parameters for Job Connections Task ID:...................... 2153 My IP:........................ 10.170.1.35 Expedition IP:................ 10.170.1.35:3306 Time Zone:.................... Europe/Helsinki dbUser (dbPassword):.......... root (************) projectName:.................. demo Parameters for Data Sources App Categories (source):........ (Expedition) CSV Files Path:................./tmp/1580321882_traffic_files.csv Parquet output path:.......... file:///data/connections.parquet Temporary folder:............. /data ---- AppID DB LOAD: Application Categories loading... Application Categories loaded Exception in thread "main" java.util.NoSuchElementException: next on empty iterator at scala.collection.Iterator$$anon$2.next(Iterator.scala:39) at scala.collection.Iterator$$anon$2.next(Iterator.scala:37) at scala.collection.IndexedSeqLike$Elements.next(IndexedSeqLike.scala:63) at scala.collection.IterableLike$class.head(IterableLike.scala:107) at scala.collection.mutable.ArrayOps$ofInt.scala$collection$IndexedSeqOptimized$$super$head(ArrayOps.scala:234) at scala.collection.IndexedSeqOptimized$class.head(IndexedSeqOptimized.scala:126) at scala.collection.mutable.ArrayOps$ofInt.head(ArrayOps.scala:234) at com.paloaltonetworks.tbd.LogCollectorCompacter$.main(LogCollectorCompacter.scala:441) at com.paloaltonetworks.tbd.LogCollectorCompacter.main(LogCollectorCompacter.scala) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.spark.deploy.JavaMainApplication.start(SparkApplication.scala:52) at org.apache.spark.deploy.SparkSubmit.org$apache$spark$deploy$SparkSubmit$$runMain(SparkSubmit.scala:849) at org.apache.spark.deploy.SparkSubmit.doRunMain$1(SparkSubmit.scala:167) at org.apache.spark.deploy.SparkSubmit.submit(SparkSubmit.scala:195) at org.apache.spark.deploy.SparkSubmit.doSubmit(SparkSubmit.scala:86) at org.apache.spark.deploy.SparkSubmit$$anon$2.doSubmit(SparkSubmit.scala:924) at org.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:933) at org.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala) SLF4J: Class path contains multiple SLF4J bindings. SLF4J: Found binding in [jar:file:/opt/Spark/extraLibraries/slf4j-nop-1.7.25.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: Found binding in [jar:file:/opt/Spark/spark-2.4.3-bin-hadoop2.7/jars/slf4j-log4j12-1.7.16.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation. SLF4J: Actual binding is of type [org.slf4j.helpers.NOPLoggerFactory] ---- CREATING SPARK Session: warehouseLocation:/data/spark-warehouse +--------+--------+-------+----+------------+ |fwSerial|panosver|csvpath|size|afterProcess| +--------+--------+-------+----+------------+ +--------+--------+-------+----+------------+ Memory: 5838m LogCollector&Compacter called with the following parameters: Parameters for execution Master[processes]:............ local[3] Available RAM (MB):........... 5978112 User:......................... admin debug:........................ false Parameters for Job Connections Task ID:...................... 2154 My IP:........................ 10.170.1.35 Expedition IP:................ 10.170.1.35:3306 Time Zone:.................... Europe/Helsinki dbUser (dbPassword):.......... root (************) projectName:.................. demo Parameters for Data Sources App Categories (source):........ (Expedition) CSV Files Path:................./tmp/1580322005_traffic_files.csv Parquet output path:.......... file:///data/connections.parquet Temporary folder:............. /data ---- AppID DB LOAD: Application Categories loading... Application Categories loaded Exception in thread "main" java.util.NoSuchElementException: next on empty iterator at scala.collection.Iterator$$anon$2.next(Iterator.scala:39) at scala.collection.Iterator$$anon$2.next(Iterator.scala:37) at scala.collection.IndexedSeqLike$Elements.next(IndexedSeqLike.scala:63) at scala.collection.IterableLike$class.head(IterableLike.scala:107) at scala.collection.mutable.ArrayOps$ofInt.scala$collection$IndexedSeqOptimized$$super$head(ArrayOps.scala:234) at scala.collection.IndexedSeqOptimized$class.head(IndexedSeqOptimized.scala:126) at scala.collection.mutable.ArrayOps$ofInt.head(ArrayOps.scala:234) at com.paloaltonetworks.tbd.LogCollectorCompacter$.main(LogCollectorCompacter.scala:441) at com.paloaltonetworks.tbd.LogCollectorCompacter.main(LogCollectorCompacter.scala) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.spark.deploy.JavaMainApplication.start(SparkApplication.scala:52) at org.apache.spark.deploy.SparkSubmit.org$apache$spark$deploy$SparkSubmit$$runMain(SparkSubmit.scala:849) at org.apache.spark.deploy.SparkSubmit.doRunMain$1(SparkSubmit.scala:167) at org.apache.spark.deploy.SparkSubmit.submit(SparkSubmit.scala:195) at org.apache.spark.deploy.SparkSubmit.doSubmit(SparkSubmit.scala:86) at org.apache.spark.deploy.SparkSubmit$$anon$2.doSubmit(SparkSubmit.scala:924) at org.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:933) at org.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala) SLF4J: Class path contains multiple SLF4J bindings. SLF4J: Found binding in [jar:file:/opt/Spark/extraLibraries/slf4j-nop-1.7.25.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: Found binding in [jar:file:/opt/Spark/spark-2.4.3-bin-hadoop2.7/jars/slf4j-log4j12-1.7.16.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation. SLF4J: Actual binding is of type [org.slf4j.helpers.NOPLoggerFactory] ---- CREATING SPARK Session: warehouseLocation:/data/spark-warehouse +--------+--------+-------+----+------------+ |fwSerial|panosver|csvpath|size|afterProcess| +--------+--------+-------+----+------------+ +--------+--------+-------+----+------------+ Memory: 5838m LogCollector&Compacter called with the following parameters: Parameters for execution Master[processes]:............ local[3] Available RAM (MB):........... 5978112 User:......................... admin debug:........................ false Parameters for Job Connections Task ID:...................... 2157 My IP:........................ 10.170.1.35 Expedition IP:................ 10.170.1.35:3306 Time Zone:.................... Europe/Helsinki dbUser (dbPassword):.......... root (************) projectName:.................. demo Parameters for Data Sources App Categories (source):........ (Expedition) CSV Files Path:................./tmp/1580328172_traffic_files.csv Parquet output path:.......... file:///data/connections.parquet Temporary folder:............. /data ---- AppID DB LOAD: Application Categories loading... Application Categories loaded Exception in thread "main" java.util.NoSuchElementException: next on empty iterator at scala.collection.Iterator$$anon$2.next(Iterator.scala:39) at scala.collection.Iterator$$anon$2.next(Iterator.scala:37) at scala.collection.IndexedSeqLike$Elements.next(IndexedSeqLike.scala:63) at scala.collection.IterableLike$class.head(IterableLike.scala:107) at scala.collection.mutable.ArrayOps$ofInt.scala$collection$IndexedSeqOptimized$$super$head(ArrayOps.scala:234) at scala.collection.IndexedSeqOptimized$class.head(IndexedSeqOptimized.scala:126) at scala.collection.mutable.ArrayOps$ofInt.head(ArrayOps.scala:234) at com.paloaltonetworks.tbd.LogCollectorCompacter$.main(LogCollectorCompacter.scala:441) at com.paloaltonetworks.tbd.LogCollectorCompacter.main(LogCollectorCompacter.scala) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.spark.deploy.JavaMainApplication.start(SparkApplication.scala:52) at org.apache.spark.deploy.SparkSubmit.org$apache$spark$deploy$SparkSubmit$$runMain(SparkSubmit.scala:849) at org.apache.spark.deploy.SparkSubmit.doRunMain$1(SparkSubmit.scala:167) at org.apache.spark.deploy.SparkSubmit.submit(SparkSubmit.scala:195) at org.apache.spark.deploy.SparkSubmit.doSubmit(SparkSubmit.scala:86) at org.apache.spark.deploy.SparkSubmit$$anon$2.doSubmit(SparkSubmit.scala:924) at org.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:933) at org.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala) SLF4J: Class path contains multiple SLF4J bindings. SLF4J: Found binding in [jar:file:/opt/Spark/extraLibraries/slf4j-nop-1.7.25.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: Found binding in [jar:file:/opt/Spark/spark-2.4.3-bin-hadoop2.7/jars/slf4j-log4j12-1.7.16.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation. SLF4J: Actual binding is of type [org.slf4j.helpers.NOPLoggerFactory] ---- CREATING SPARK Session: warehouseLocation:/data/spark-warehouse +--------+--------+-------+----+------------+ |fwSerial|panosver|csvpath|size|afterProcess| +--------+--------+-------+----+------------+ +--------+--------+-------+----+------------+ Memory: 5838m LogCollector&Compacter called with the following parameters: Parameters for execution Master[processes]:............ local[3] Available RAM (MB):........... 5978112 User:......................... admin debug:........................ false Parameters for Job Connections Task ID:...................... 2158 My IP:........................ 10.170.1.35 Expedition IP:................ 10.170.1.35:3306 Time Zone:.................... Europe/Helsinki dbUser (dbPassword):.......... root (************) projectName:.................. demo Parameters for Data Sources App Categories (source):........ (Expedition) CSV Files Path:................./tmp/1580328212_traffic_files.csv Parquet output path:.......... file:///data/connections.parquet Temporary folder:............. /data ---- AppID DB LOAD: Application Categories loading... Application Categories loaded Exception in thread "main" java.util.NoSuchElementException: next on empty iterator at scala.collection.Iterator$$anon$2.next(Iterator.scala:39) at scala.collection.Iterator$$anon$2.next(Iterator.scala:37) at scala.collection.IndexedSeqLike$Elements.next(IndexedSeqLike.scala:63) at scala.collection.IterableLike$class.head(IterableLike.scala:107) at scala.collection.mutable.ArrayOps$ofInt.scala$collection$IndexedSeqOptimized$$super$head(ArrayOps.scala:234) at scala.collection.IndexedSeqOptimized$class.head(IndexedSeqOptimized.scala:126) at scala.collection.mutable.ArrayOps$ofInt.head(ArrayOps.scala:234) at com.paloaltonetworks.tbd.LogCollectorCompacter$.main(LogCollectorCompacter.scala:441) at com.paloaltonetworks.tbd.LogCollectorCompacter.main(LogCollectorCompacter.scala) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.spark.deploy.JavaMainApplication.start(SparkApplication.scala:52) at org.apache.spark.deploy.SparkSubmit.org$apache$spark$deploy$SparkSubmit$$runMain(SparkSubmit.scala:849) at org.apache.spark.deploy.SparkSubmit.doRunMain$1(SparkSubmit.scala:167) at org.apache.spark.deploy.SparkSubmit.submit(SparkSubmit.scala:195) at org.apache.spark.deploy.SparkSubmit.doSubmit(SparkSubmit.scala:86) at org.apache.spark.deploy.SparkSubmit$$anon$2.doSubmit(SparkSubmit.scala:924) at org.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:933) at org.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala) ubuntu@ip-10-170-1-35:/tmp$    ... View more

/etc/hostname shows ip-10-170-1-35 etc/hosts - changed from "127.0.0.1 localhost" to :127.0.0.1 ip-10-170-1-35 localhost"      Now I get a weird message stating http://10.170.1.135:4050   Then the process fails again. My ML settings seem to look fine.   Any idea what else is causing this?         ... View more

Having the same problem and cannot figure why Expedition will not process the CSV files.  www-data is in the expedition group and has the permission to access the CSV files.  Please help!       ubuntu@ip-10-170-1-35:/$ tail -f /tmp/error_logCoCo at org.apache.spark.util.Utils$.localCanonicalHostName(Utils.scala:996) at org.apache.spark.internal.config.package$.<init>(package.scala:302) at org.apache.spark.internal.config.package$.<clinit>(package.scala) ... 17 more Caused by: java.net.UnknownHostException: ip-10-170-1-35: Name or service not known at java.net.Inet6AddressImpl.lookupAllHostAddr(Native Method) at java.net.InetAddress$2.lookupAllHostAddr(InetAddress.java:929) at java.net.InetAddress.getAddressesFromNameService(InetAddress.java:1324) at java.net.InetAddress.getLocalHost(InetAddress.java:1501) ... 26 more ... View more

I solved the issue by editing the  /etc/ssh/sshd_config, changing "PasswordAuthentication no" to "PasswordAuthentication yes", saving the file and restarting the ssh service - sudo service ssh restart.  Now the "expedition" username and passwords works properly.  The Expedition-LogAnalysisGuide_v1.0.2.pdf guide should be updated with these steps for people who use Expedition in AWS.   ... View more

Never mind.  I figured out the issue.  Was behind a firewall and did not realize Expedition was trying to contact the firewalls to create the API key.  Update the firewall rules and it is all fixed now.   ... View more

That is fine.  We converted the OVA to an AMI and have Expedition running in AWS now.   ... View more

Ok, I go it to work.  The access-group does work, I just needed to go into the policies select and do a discovery again manually.  The security rules went from 20 to 89 now.  So it I am on the right track now.   ... View more

Before I added the access-group to the config file, I was only getting 20 security rules from the expedition tool.  After I add the lines below, I still only get 20 security rules.    access-group AWS_Prod_VPC_Filter in interface IVDC-rsvpn-untrust-599 access-group AWS_SharedServices_Prod_VPC_Filter in interface IVDC-rsvpn-untrust-599   In addition, there are no interfaces for the access-lists in the configuration.  It goes through the tunnel interface of the Cisco ASA firewall which goes through the ASIC and is not a defined interface like on a Palo Alto firewall.  Is it possible I am still doing something wrong here with the configuration?   ... View more