apache/hadoop · critical · YarnRuntimeException

History Server Failed to login

Error message

History Server Failed to login

What it means

JobHistoryServer.serviceInit performs the security login (doSecureLogin) based on hadoop.security.authentication and the JHS principal/keytab properties. Any IOException from the login is wrapped in YarnRuntimeException 'History Server Failed to login' and aborts startup with the cause preserved. Typical roots are Kerberos misconfiguration, a missing or unreadable keytab, a mismatched principal, or KDC/clock problems.

Source

Thrown at hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-hs/src/main/java/org/apache/hadoop/mapreduce/v2/hs/JobHistoryServer.java:127

      }
      super.serviceStop();
    }
  }

  public JobHistoryServer() {
    super(JobHistoryServer.class.getName());
  }

  @Override
  protected void serviceInit(Configuration conf) throws Exception {
    Configuration config = new YarnConfiguration(conf);

    // This is required for WebApps to use https if enabled.
    MRWebAppUtil.initialize(getConfig());
    try {
      doSecureLogin(conf);
    } catch(IOException ie) {
      throw new YarnRuntimeException("History Server Failed to login", ie);
    }
    jobHistoryService = new JobHistory();
    stateStore = createStateStore(conf);
    this.jhsDTSecretManager = createJHSSecretManager(conf, stateStore);
    clientService = createHistoryClientService();
    aggLogDelService = new AggregatedLogDeletionService();
    hsAdminServer = new HSAdminServer(aggLogDelService, jobHistoryService);
    addService(stateStore);
    addService(new HistoryServerSecretManagerService());
    addService(jobHistoryService);
    addService(clientService);
    addService(aggLogDelService);
    addService(hsAdminServer);

    DefaultMetricsSystem.initialize("JobHistoryServer");
    JvmMetrics jm = JvmMetrics.initSingleton("JobHistoryServer", null);
    pauseMonitor = new JvmPauseMonitor();
    addService(pauseMonitor);

View on GitHub (pinned to 2add963021)

Solutions

1. Verify the keytab exists and is readable by the JHS user; validate manually with kinit -kt <keytab> <principal>.
2. Check mapreduce.jobhistory.principal uses the correct primary and that _HOST resolves to the actual host.
3. Confirm the KDC is reachable and system clocks are synchronized.
4. Fix the configuration, redeploy the keytab, and restart JHS.

# validate the login before starting JHS
kinit -kt /etc/security/keytab/jhs.service.keytab jhs/_HOST@EXAMPLE.COM \
  || echo 'keytab/principal invalid — fix before start'
klist -k /etc/security/keytab/jhs.service.keytab | head

When it happens

Trigger: hadoop.security.authentication=kerberos with mapreduce.jobhistory.keytab missing or unreadable; mapreduce.jobhistory.principal not matching the keytab principal; KDC unreachable; clock skew beyond Kerberos tolerance.

Common situations: Keytab not deployed or rotated without updating the path; principal format wrong or _HOST resolving incorrectly; hostname/DNS mismatch; KDC outage at restart time.

Related errors

• Security is enabled but block access tokens (via dfs.block.a
• Unable to bind on specified streaming port in secure context
• Unable to bind on specified info port in secure context. Nee
• Failed to create SecretManager
• Can't get Master Kerberos principal for use as renewer

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/6b0c6bd641a012db. Report an issue: GitHub.