apache/hadoop · critical · RuntimeException

Failed to load %s, please check configuration hadoop.kms.aud

Error message

Failed to load %s, please check configuration hadoop.kms.audit.logger

What it means

KMS builds its audit logger list from the kms-site.xml property hadoop.kms.audit.logger (KMSConfiguration.KMS_AUDIT_LOGGER_KEY), a list of class names implementing KMSAuditLogger. In getAuditLoggerClasses (KMSAudit.java:135), if Configuration.getClassByName throws ClassNotFoundException for one of the names, KMS wraps it in a RuntimeException 'Failed to load <class>, please check configuration hadoop.kms.audit.logger' during webapp initialization, which prevents the KMS from starting.

Source

Thrown at hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSAudit.java:135

   */
  private Set<Class<? extends KMSAuditLogger>> getAuditLoggerClasses(
      final Configuration conf) {
    Set<Class<? extends KMSAuditLogger>> result = new HashSet<>();
    // getTrimmedStringCollection will remove duplicates.
    Collection<String> classes =
        conf.getTrimmedStringCollection(KMSConfiguration.KMS_AUDIT_LOGGER_KEY);
    if (classes.isEmpty()) {
      LOG.info("No audit logger configured, using default.");
      result.add(SimpleKMSAuditLogger.class);
      return result;
    }

    for (String c : classes) {
      try {
        Class<?> cls = conf.getClassByName(c);
        result.add(cls.asSubclass(KMSAuditLogger.class));
      } catch (ClassNotFoundException cnfe) {
        throw new RuntimeException("Failed to load " + c + ", please check "
            + "configuration " + KMSConfiguration.KMS_AUDIT_LOGGER_KEY, cnfe);
      }
    }
    return result;
  }

  /**
   * Create a collection of KMSAuditLoggers from configuration, and initialize
   * them. If any logger failed to be created or initialized, a RunTimeException
   * is thrown.
   */
  private void initializeAuditLoggers(Configuration conf) {
    Set<Class<? extends KMSAuditLogger>> classes = getAuditLoggerClasses(conf);
    Preconditions
        .checkState(!classes.isEmpty(), "Should have at least 1 audit logger.");
    for (Class<? extends KMSAuditLogger> c : classes) {
      final KMSAuditLogger logger = ReflectionUtils.newInstance(c, conf);
      auditLoggers.add(logger);

View on GitHub (pinned to 2add963021)

Solutions

1. Check the kms-site.xml value of hadoop.kms.audit.logger for typos in the fully-qualified class names
2. If the logger is a custom class, install its jar (and deps) into the KMS classpath (e.g. share/hadoop/kms/webapp/WEB-INF/lib or the KMS lib dir) and restart
3. If you do not need a custom logger, remove the property entirely to fall back to SimpleKMSAuditLogger
4. Verify the class implements KMSAuditLogger (it is loaded with asSubclass(KMSAuditLogger.class))

Example fix

<!-- before -->
<property><name>hadoop.kms.audit.logger</name>
  <value>com.mycompany.KmsAuditLogger</value></property>
<!-- after: jar installed, or drop back to default -->
<property><name>hadoop.kms.audit.logger</name>
  <value>org.apache.hadoop.crypto.key.kms.server.SimpleKMSAuditLogger</value></property>

// Pre-flight before enabling a custom audit logger
String cls = "com.mycompany.KmsAuditLogger";
try { Class<?> c = Class.forName(cls);
  Preconditions.checkArgument(KMSAuditLogger.class.isAssignableFrom(c)); }
catch (ClassNotFoundException e) { /* install the jar before configuring */ }

When it happens

Trigger: Setting hadoop.kms.audit.logger to a class that is not on the KMS classpath or is misspelled — e.g. 'org.apache.hadoop.crypto.key.kms.server.SimpleKMSAuditLogger' typo'd, or a custom audit logger class whose jar was not dropped into the KMS webapp/classpath. Leaving the property empty is safe (SimpleKMSAuditLogger is used).

Common situations: Deploying a custom audit logger and forgetting to install its jar; fully-qualified class name typos; class moved/renamed between Hadoop versions; copy-pasting audit logger config from a different product layout (class exists in HDFS but not hadoop-kms).

Related errors

• Failed to initialize %s
• System property 'kms.config.dir' must be an absolute path: %
• System property 'kms.config.dir' not defined
• System property 'log4j.configuration' not defined
• No KeyProvider has been defined

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/0356450346c6d317. Report an issue: GitHub.