Inverse DNS resolution with HBase and Phoenix

Recently I did some quick experiments with HBase (1.1.2) and Phoenix (4.6.0). As a quite big dataset I used the DNS data available as a dnscensus 2013 archive. This dataset contains DNS data collected by extraction of port 53 data out of network captures at some central internet routers. Here some examples:

To get the inverse map of all collected type A DNS requests the phoenix table should have a key starting with the ip address! Don’t confuse reverse dns lookup (PTR) with the inverse of a type A DNS request!

The table create script for phoenix looks like

To get the original data in the right order I used sed

A bit tricky was the line endings of the original file data, why I used .* to rid of all type of white spaces after the ip addresses. The tail command just removes the header line, which is not needed when the data get imported into phoenix.

How many rows do we have?

Loading the csv data into phoenix is quite simple with the bulk load utility:


The result is a list of dns names which resolve to the ip of google’s public dns server!

The select from a table with almost 1 billion of rows took less than a 10th of a second! Nice 🙂

Hadoop 2.6.0 API Javadoc (with private classes/methods)

If you ever wrote some MapReduce program using SequenceFile you may have asked yourself what methods in detail are available in the class created by the methods createWriter( ). The standard javadoc from apache’s website doesn’t show this information:


This is why I regenerated the javadoc from the sources with private classes / methods enabled.


You can view the javadocs online or you can download the tarball:

Hadoop 2.6.0 javadoc with private classes/methods (view online)

Hadoop 2.6.0 javadoc with private classes/methods (tarball)

chukwa usage with hadoop 2 (2.4.0) and hbase 0.98

If you want to use chukwa with hadoop 2.4.0 and hbase 0.98 you need to exchange some jars, because the trunk version uses older versions of hadoop and hbase (at the time of writing).

To be sure that I have the newest version I cloned the sources from the github repository

using the git command

In the local chukwa directory the build is easy done using maven:

After the successful maven build the fresh tarball of chukwa should be available in the target subdirectory.

Now we can untar the tarball in a place of our choice and configure chukwa like it is described in the tutorial. The hbase schema file has some small typos which I corrected in a fork.

Before starting chukwa we have to exchange some jars. First turn off some jars that are for older hadoop / hbase versions.

Copy the following jars from the hadoop and/or hbase distribution to the same chukwa directory.

Now I started a chukwa collector on my namenode and a agent on a linux box. After some minutes the first log data can be seen in HBase:

If writing to hdfs you will see something like:


Apache Hadoop 2.4.0 binary build for 64bit debian linux

At the time of writing this blog apache hadoop builds from the apache website are compiled for 32bit platforms. If you use this on a 64bit platform (with Java 64 bit) you might get some error messages regarding the shared library

I have now compiled hadoop 2.4.0 on debian 7.4 (wheezy) 64 bit.

With this version I didn’t get again this error message.

The error message is a bit misleading, but some other blogs as well as a small hint in the documentation page

Native library documentation

directed me to a compilation of hadoop from the source tarball. The build was straight forward with the command

mvn package -Pdist,native -DskipTests=true -Dtar

after installation of necessary packages that have been missing in my box:

For those who want to start directly with the tarball compiled for 64bit platforms find here my hadoop 2.4.0 bundle:





Lambda Architecture vs. Java 8 Lambdas

Actually the Lambda buzz word appears often in IT publications. Some reader may get confused and put the article in the wrong context, because actually there are two completely different topics with a similarity in the title: Lambda (λ)

1. Java SE 8 Lambdas

Lambdas introduced with the new Java SE 8 targets functional programming aspects.

With the introduction of lamdas, Java has now the ability to handle funtions as method parameters. Other programming languages belonging to the class of functional programming languages are: Haskell, Clojure, Lisp

Here an example taken from the Java SE documentation page:

Call a method an put functions as parameters:


2. Lambda Architecture (Big Data)

Lambda Architecture was introduced by Nathan Marz. It describes roughly spoken a design in the big data area, which combines a batch layer of data processing (with higher latency) with a speed layer that makes use of stream processing tools like Storm to produce real time views. The user gets data combined from both layers so that he can see actual data in real time. Real time views from the batch layer, which typically uses Hadoop’s MapReduce to aggregate/transform raw input data, can be achieved by using elephantDB. The layer between the batch layer and the user is called serving layer.

Have a look to Nathan Marz’s book, chapter 1, section 1.7 Summary of the Lambda Architecture to get more informations about this.


Hadoop WebHDFS usage in combination with HAR (hadoop archive) from PHP

Hadoop is not very efficient for storing a lot of smaller files.

If you need to access a lot of files nevertheless you can use HAR to get rid of the small file problem. Here are the steps that I did to get access to the files from PHP.

1. Copy the files from local filesystem to HDFS

2. Create a hadoop archive

Let hadoop create ONE single HAR file with name hadoop-api.har from the whole directory
/tmp/har/ (HDFS)

This command will start a MapReduce job that creates the HAR file without deleting the original small files in HDFS.

3. Delete the small files from HDFS

4. HAR file content (HAR filesystem)

5. HAR file content (HDFS filesystem)

The HAR file is not really just one file but a directory with a couple of files. Let’s have a look to it with raw hdfs commands

6. Structure of the HAR file index (how to get access the single files)

hdfs dfs -cat /har/hadoop-api.har/_index
%2Fapi%2Forg%2Fapache%2Fhadoop%2Fio%2Fserializer%2Fclass-use%2FJavaSerialization.html file part-0 17439924 4592 1401786436896+420+hadoop+supergroup
%2Fapi%2Fsrc-html%2Forg%2Fapache%2Fhadoop%2Frecord%2Fmeta%2FUtils.html file part-0 86374093 9779 1401786547239+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Fhttp%2Flib%2FStaticUserWebFilter.StaticUserFilter.html file part-0 12578713 14088 1401786409718+420+hadoop+supergroup
%2Fapi%2Fsrc-html%2Forg%2Fapache%2Fhadoop%2Ffs%2Fftp%2FFTPFileSystem.html file part-0 33753102 56570 1401786511587+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Frecord%2Fcompiler%2Fclass-use%2FConsts.html file part-0 23911123 4493 1401786471791+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Fsecurity%2Fproto%2Fclass-use%2FSecurityProtos.GetDelegationTokenResponseProto.html file part-0 27203013 22194 1401786486455+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Fha%2FFenceMethod.html file part-0 9642822 11698 1401786398308+420+hadoop+supergroup

=>  %2Fapi%2Forg%2Fapache%2Fhadoop%2Fservice%2Fclass-use%2FService.html file part-0 27995653 13268 1401786490938+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Fha%2Fproto%2Fclass-use%2FHAServiceProtocolProtos.MonitorHealthRequestProto.html file part-0 11807109 26499 1401786404845+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Ffs%2Fpermission%2Fclass-use%2FAccessControlException.html file part-0 8820869 4647 1401786392428+420+hadoop+supergroup
%2Fapi%2Fsrc-html%2Forg%2Fapache%2Fhadoop%2Fipc%2Fprotobuf%2FRpcHeaderProtos.RpcRequestHeaderProto.OperationProto.html file part-0 76175228 529335 1401786535978+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Ffs%2FHardLink.LinkStats.html file part-0 6370459 15816 1401786381184+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Fio%2FMapFile.Reader.html file part-0 13487270 42673 1401786413666+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Fio%2FRawComparator.html file part-0 13752188 12048 1401786415087+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Frecord%2Fcompiler%2Fclass-use%2FJByte.html file part-0 23924635 4482 1401786472012+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Futil%2Fclass-use%2FShell.OSType.html file part-0 29576158 7120 1401786501833+420+hadoop+supergroup
%2Fapi%2Fsrc-html%2Forg%2Fapache%2Fhadoop%2Fha%2Fproto%2FHAServiceProtocolProtos.TransitionToActiveRequestProtoOrBuilder.html file part-0 46601135 515881 1401786515905+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Fnet%2Funix%2Fpackage-summary.html file part-0 23093614 4293 1401786467275+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Fipc%2Fprotobuf%2Fclass-use%2FRpcHeaderProtos.RpcResponseHeaderProtoOrBuilder.html file part-0 20622979 7652 1401786447960+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Fio%2Fretry%2Fclass-use%2FAtMostOnce.html file part-0 17192339 4502 1401786434497+420+hadoop+supergroup
%2Fapi%2Forg%2Fapache%2Fhadoop%2Ftools%2Fproto%2Fclass-use%2FGetUserMappingsProtocolProtos.GetUserMappingsProtocolService.html file part-0 28531720 7322 1401786494023+420+hadoop+supergroup

Each row of the index file contains several space-separated columns:

  • The url encoded path in the HAR file
  • The type of the entry, i.e. file or dir
  • The HDFS file which contains the content
  • The offset in the HDFS content file
  • The length of the file

7. Example access using curl

8. PHP access to WebHDFS

In a simple php script the HAR index file is loaded, parsed and used to construct the URL to download the content of the file (inside the HAR), where the local / relative path is append to the php script URL:

The part behind index.php [/api/org/apache/hadoop/ha/proto/class-use/HAServiceProtocolProtos.MonitorHealthRequestProto.html] is a example html file which is included in the HAR file.

The php file’s source is

 9. Remarks

It would be great if the WebHDFS implementation would allow to access a har filesystem directly.

[1] WebHdfs

Hadoop’s mapreduce on YARN: What the framework does before your Mapper/Reducer methods are called

0. Motivation

In several situations it is important to have a deeper understanding of the framework to write mapreduce programs that are more complex than the typical WordCount examples.

In all publications and books that I saw those details are not explained, so that I had to evaluate the details by myself. I used hadoop 2.3.0 source code for my analysis.

My goal was to get answers to the following questions:

  1. Where does the serialization takes place?
  2. Where are the key/value pairs generated from the HDFS file data?
  3. Which class makes the loop over all key/value pairs?
  4. How is Avro serialization detected/choosen and why are the special Avro map reduce classes necessary?

1. Method call stack

To get started with the analysis, I wrote an example MapReduce application and I included the following dummy Exception to get the stack trace:

The resulting stack trace delivers to following informations:

Noclass namemethod namesource code row
6org.apache.hadoop.mapred.MapTask run340
7org.apache.hadoop.mapred.MapTask runNewMapper764

2. Remarks to the different steps

2.1 – 2.5 Dispatching Job context

In steps 1 – 5 the job context is dispatched with some more general initializations steps that are not so relavant for my actual interests of this blog.

2.6 and 2.7 runNewMapper

Steps 6 is just calling 7 using the umbilical that is connecting the application master of the job with the worker nodes that execute the tasks (map and reduce).

First the mapper and input format classes are created using the informations from the job/task context.

Next the RecordReader is created using the now available input format instance. NewTrackingRecordReader is a inner class defined in MapTask. The constructor creates a instance of a mapreduce.RecordReader using

This RecordReader is used in the to get key/value pairs. In my example the RecordReader was the one from the SequenceFile:

As we can see, the method nextKeyValue internally calls the corresponding methods of SequenceFile.Reader which is associated with the SequenceFileInputFormat I used in my Job definition.

The keyDeserializer is created in the init method of SequenceFile.Reader using the SerializationFactory. How this works will be explained soon.

The serializer and deserializer is retrieved by the SerializationFactory which makes use of the Serializations registered in the JobContext / Configuration. First the constructur fills a List with all registered Serializations. The serialization to be used to serialize and deserialize a instance of a class is determined in the method getSerialization which loops over all serializations and checks if the accept method indicates that the serialization can be used for the given class.

 2.8 Mapper delegation to custom map method

The custom Mapper extends the framework Mapper. The framework calls a default identity implementation of the map method which is typically overwritten by the custom Mapper implementation.

2.9 Custom Mapper implementation

In this way the run method delegates the request to the cutom map implementation.

3. Answers to the questions

3.1 Where does the serialization takes place?

The configured InputFormat creates a RecordReader/Reader which determines the serialization which is usable for the configured key / value class. In my example I used a SequenceFile as input, where the key and value classes of the input are read from the SequenceFile header block (before real data are loaded).

From the RecordReader perspective deserialized key or value instances are loaded from the HDFS File (Split).

3.2 Where are the key/value pairs generated from the HDFS file data?

The inner class Reader of SequenceFile calls the methods of the Serialization implementation to deserialize the data and delivers the object instances to the calling instances.

3.3 Which class makes the loop over all key/value pairs?

The run method of class org.apache.hadoop.mapreduce.Mapper loop as long as context.nextKeyValue() is true. With the retrieved key and values the Mapper calls the custom implementation of the map method.

3.4 How is Avro serialization detected/choosen and why are the special Avro map reduce classes necessary?

The class SerializationFactory checks which Serializer accepts the requested class. If the Avro Serialization accepts this class (if the class is a Avro class), this Serialization is used for serializing and deserializing the data.

The second part of this question is not answered by my analysis (yet)….. to be continued


Avro reuse of custum defined types

It took me some time to find out that avro allows us to reuse custum types so that we get can build complex types that are composed of other complex types that we defined by ower own.

Look at the following example schema definition:

This kind of schema definitions is allowed if there is another schema definition file which defines the type org.woopi.avro.CompoundSubTypeExtended.

I used the following example for my tests:

If you compile the files with the Avro schema compiler that is included in the avro tools jar file avro-tools-1.7.6.jar that can be downloaded from Avro java jar mirror,it is important that the compiler gets all schema files at once so that it has a possibility to get informations from one type to be used in another one.

It is possible to use the java command with multiple single schema files and directories as input:

Or for ANT fans:

Hadoop / YARN / Tez

0. Introductary Remarks

Here my extended version of the installation / deploy documentation of Tez. The original version can seen on the Tez webpage

I have used hadoop 2.3.0 to try the Tez installation. So I assume here that your hadoop cluster ist already up and running. Look on the webpage of hadoop for installation instructions if you have not already a running hadoop cluster.

My version of hadoop is running on debian Wheezy.

1. Download the Tez tarball

You can get the source tarball of tez from it’s apache incubator page.

2. Compile the sources using maven

Before starting maven to build tez we have to change the pom.xml file in the root directory of the unzipped tez directory. In my case I changed the hadoop version property hadoop.version from 2.2.0 to 2.3.0.

After starting maven with the following command, usually some missing jars are downloaded from the central repository.

3. Adapting configuration files

3.1 Add TEZ variables to .bashrc

As hadoop user edit ~/.bashrc and append the following lines

3.2 Add Tez jars to the hadoop environment shell script

Edit ${HADOOP_INSTALL}/etc/hadoop/

Right after the lines

add the following new lines to add tez jars

 3.3 Upload tez jars to hdfs

 3.4. Create a tez configuration file

Create/Edit the file tez-site.xml in ${HADOOP_INSTALL}/etc/hadoop/

3.5 Configure MapReduce to use yarn-tez instead of yarn

Create or edit mapred-site.xml in ${HADOOP_INSTALL}/etc/hadoop/

3.6 Start or restart yarn



4. Start a tez example

In the tez tarball are several examples included. Let’s start the orderedwordcount example.

Create a hdfs dir /tests/tez-examples/in and copy some text files of your choice to it.

Then execute the command:

The output should look similar to mine here: