Troubleshoot the Pentaho system

Use these categories to troubleshoot common issues.

If you installed Pentaho Server on your own Tomcat, pentaho.log is under pentaho-server/tomcat/logs.

You can monitor transformations, jobs, and database connections through PDI logging. For the Pentaho Server, review pentaho.log in pentaho-server/logs.

Use logging first when you troubleshoot Pentaho components. Logging helps you validate behavior and narrow root causes fast.

In this topic

• General issues

• Security issues

• Pentaho Server issues

• Pentaho Repository issues

• Archived content

General issues

Resolve common issues with the Pentaho suite.

JDBC driver issues

Make sure the correct JDBC driver JARs are installed. Remove conflicting driver versions.

If you use the JDBC Distribution Tool, it can place drivers correctly. For more details, see Install Pentaho Data Integration and Analytics.

To install a JDBC driver for the Pentaho Server:

1. Stop the Pentaho Server.

2. Copy the driver JAR to <pentaho-install-directory>/server/pentaho-server/tomcat/lib.

3. Start the Pentaho Server.

Data conversion issues with MySQL driver 5.0.8

MySQL JDBC driver version 5.0.8 can cause data conversion errors. Numeric-to-string conversions may return a byte array instead of a string.

Replace mysql-connector-java-5.0.8.jar with mysql-connector-java-5.0.7.jar. Restart your client tool or application server.

Fixing JTDS varchar(Max) limitations in MSSQL 2005

Reports that use varchar(MAX) can return a net.sourceforge.jtds.jdbc.ClobImpl@... error. This is a known limitation in older JTDS drivers.

Upgrade to Microsoft SQL Server JDBC driver version 1.0.809.102 or later. Download the driver from Microsoft. Restart SQL Server.

Security issues

Tune security logging and troubleshoot authentication issues.

In this section

• Increase security log levels in the Pentaho Server

• Log output security analysis

• LDAP roles issues with Admin and Authenticated

• With LDAP authentication, the PDI Repository Explorer is empty

• LDAP incorrectly authenticates user IDs that do not match letter case

• Connection timeout issues when using CAS

• Cannot change Administrator password in PUC

• Snowflake logging errors

Increase security log levels in the Pentaho Server

The security logging facilities of the Pentaho Server are set to ERROR by default. This level might not provide enough detail for troubleshooting.

Use this procedure to enable verbose security logging.

1. Stop the Pentaho Server.

   sh /usr/local/pentaho/server/pentaho-server/stop-pentaho.sh

2. Open /pentaho/server/pentaho-server/tomcat/webapps/pentaho/WEB-INF/classes/log4j2.xml.

3. Change or add the ThresholdFilter value in the <Console> or <RollingFile> sections. Use WARN, ERROR, FATAL, or DEBUG.

   <Console name="PENTAHOCONSOLE">
     <ThresholdFilter level="ERROR"/>
     <PatternLayout>
       <Pattern>%d{ABSOLUTE} %-5p [%c{1}] %m%n</Pattern>
     </PatternLayout>
   </Console>

4. Add the following log statements directly above the Root element:

   <!-- all Spring Security classes will be set to DEBUG -->
   <Logger name="org.springframework.security" level="DEBUG"/>
   
   <!-- all Pentaho security-related classes will be set to DEBUG -->
   <Logger name="org.pentaho.platform.engine.security" level="DEBUG"/>
   <Logger name="org.pentaho.platform.plugin.services.security" level="DEBUG"/>

5. Save the file.

6. Edit the Spring Security configuration file for your security provider in /pentaho/server/pentaho-server/pentaho-solutions/system/.

   • applicationContext-spring-security-memory.xml

   • applicationContext-spring-security-jdbc.xml

   • applicationContext-spring-security-ldap.xml

7. Find the daoAuthenticationProvider bean definition.

8. Add this property anywhere inside the bean, before </bean>:

   <property name="hideUserNotFoundExceptions" value="false" />

9. Save the file.

10. Start the Pentaho Server.

    sh /usr/local/pentaho/server/pentaho-server/start-pentaho.sh

Verbose security messages are written to /pentaho/server/pentaho-server/logs/pentaho.log. Reduce logging when you finish testing to prevent the log from growing too large.

Enable extra LDAP security logging

Use this procedure when you need more LDAP details in pentaho.log.

Use this in testing or pre-production only. User names and passwords are logged in plain text.

1. Stop the Pentaho Server.

2. Open applicationContext-spring-security-ldap.xml from /pentaho/server/pentaho-server/pentaho-solutions/system.

3. Locate the bean declaration for DefaultLdapAuthenticationProvider.

4. Replace the constructor-arg bean.

   Old bean:

   <constructor-arg>
     <ref bean="authenticator" />
   </constructor-arg>

   New bean:

   <constructor-arg>
     <ref bean="ldapAuthenticatorProxy" />
   </constructor-arg>

5. Open pentaho-spring-beans.xml in the same directory.

6. Add this import line:

   <import resource="applicationContext-logging.xml" />

7. Save the file.

8. Open log4j2.xml from /pentaho-server/tomcat/webapps/pentaho/WEB-INF/classes.

9. Add this logger:

   <Logger name="org.springframework.security.providers" level="DEBUG"/>

10. Save the file.

11. Start the Pentaho Server.

Log output security analysis

Use these examples to locate security configuration issues in pentaho.log.

• When you request a protected page while not signed in:

  DEBUG [ExceptionTranslationFilter] Access is denied (user is anonymous);
              redirecting to authentication entry point org.springframework.security.AccessDeniedException:
              Access is denied

• When the user name or password does not match what is stored in the back end:

  WARN [LoggerListener] Authentication event
              AuthenticationFailureBadCredentialsEvent: suzy; details:
              org.springframework.security.ui.WebAuthenticationDetails@fffd148a: RemoteIpAddress: 127.0.0.1;
              SessionId: 976C95033136070E0200D6DA26CB0277; exception: Bad credentials

• When authentication succeeds:

  WARN [LoggerListener] Authentication event InteractiveAuthenticationSuccessEvent:
              suzy; details: org.springframework.security.ui.WebAuthenticationDetails@fffd148a: RemoteIpAddress:
              127.0.0.1; SessionId: 976C95033136070E0200D6DA26CB0277 DEBUG
              [HttpSessionContextIntegrationFilter] SecurityContext stored to HttpSession:
              'org.springframework.security.context.SecurityContextImpl@2b86afeb: Authentication:
              org.springframework.security.providers.UsernamePasswordAuthenticationToken@2b86afeb: Username:
              org.springframework.security.userdetails.ldap.LdapUserDetailsImpl@d7f51e; Password: [PROTECTED];
              Authenticated: true; Details: org.springframework.security.ui.WebAuthenticationDetails@fffd148a:
              RemoteIpAddress: 127.0.0.1; SessionId: 976C95033136070E0200D6DA26CB0277; Granted
              Authorities: ROLE_CTO, ROLE_IS, ROLE_AUTHENTICATED'

After InteractiveAuthenticationSuccessEvent, the filters show the roles fetched for the user. Compare these roles to the page-role mapping in the filterInvocationInterceptor bean in applicationContext-spring-security.xml.

If you are troubleshooting LDAP, look for output like this:

DEBUG [DirMgrBindAuthenticator] (LoggingInterceptor) Return value: LdapUserInfo:
            org.springframework.security.providers.ldap.LdapUserInfo@1f31c64[dn=uid=suzy,ou=users,ou=system,attributes={mail=mail:
            [email protected], uid=uid: suzy, userpassword=userpassword: [B@e17c9c,
            businesscategory=businesscategory: cn=cto,ou=roles,ou=system, cn=is,ou=roles,ou=system,
            objectclass=objectClass: organizationalPerson, person, groupOfUniqueNames,
            inetOrgPerson, top, uniquemember=uniquemember: cn=cto, ou=roles, cn = is , ou = roles,
            sn=sn: Pentaho, cn=cn: suzy}]

LDAP roles issues with Admin and Authenticated

Do not use Admin and Authenticated roles in LDAP. Use pentahoAdmins and pentahoUsers, or other clear names.

1. Open /pentaho-solutions/system/applicationContext-spring-security.xml.

2. At the bottom, find URL security entries like:

   A/docs/.*Z=Anonymous,Authenticated

3. Replace Authenticated with pentahoUsers (or your chosen name).

   Example:

   A/docs/.*Z=Anonymous,pentahoUsers

4. Replace Admin with pentahoAdmins (or your chosen name).

5. Edit /pentaho-solutions/system/repository.spring.xml.

6. Change the authenticated role name.

   From:

   <bean id="singleTenantAuthenticatedAuthorityName" class="java.lang.String">
       <constructor-arg value="Authenticated" />
      </bean>

   To:

   <bean id="singleTenantAuthenticatedAuthorityName" class="java.lang.String">
       <constructor-arg value="pentahoUsers" />
      </bean>

7. Change the admin role name.

   From:

   <bean id="singleTenantAdminAuthorityName" class="java.lang.String">
       <constructor-arg value="Admin" />
      </bean>

   To:

   <bean id="singleTenantAdminAuthorityName" class="java.lang.String">
       <constructor-arg value="pentahoAdmins" />
      </bean>

With LDAP authentication, the PDI Repository Explorer is empty

This can happen when you log on to a solution repository from the PDI client, then later switch authentication to LDAP. Repository IDs and security structures can become inconsistent.

To fix it, delete security settings created by the previous authentication method. This forces the server to regenerate settings for LDAP.

This procedure removes existing Pentaho Repository users, roles, and access controls. Back up the directories before you delete them.

1. Stop the Pentaho Server.

2. Delete the security and default directories from:

   /pentaho-solutions/system/jackrabbit/repository/workspaces/

3. Start the Pentaho Server.

LDAP incorrectly authenticates user IDs that do not match letter case

Some LDAP implementations are case-insensitive. This is common in Microsoft Active Directory.

This can allow bILL to authenticate as Bill. It can also grant incorrect access.

1. Stop the Pentaho Server.

2. Edit /pentaho/server/pentaho-server/pentaho-solutions/system/applicationContext-spring-security-ldap.xml.

3. Find this bean:

   <bean class="org.pentaho.platform.plugin.services.security.userrole.ldap.DefaultLdapAuthenticationProvider">

4. Below the last </constructor-arg> in that bean, add:

   <property name="userDetailsContextMapper">
       <ref bean="ldapContextMapper" />
   </property>

5. After the </bean> tag for daoAuthenticationProvider, add this bean. Set ldapUsernameAttribute to match your environment:

   <bean id="ldapContextMapper" class="org.pentaho.platform.engine.security.UseridAttributeLdapContextMapper">
       <property name="ldapUsernameAttribute" value="samAccountName" />
   </bean>

6. Start the Pentaho Server.

Connection timeout issues when using CAS

CAS session timeouts can prevent sign-in. They can also block data reloads until users refresh the page.

Configure the Pentaho session timeout to exceed the CAS session timeout.

1. Stop the Pentaho Server.

2. Open pentaho-server/tomcat/webapps/pentaho/WEB-INF/web.xml.

3. Find session-config.

4. Increase session-timeout (default is 120 minutes).

   <session-config>
     <tracking-mode>COOKIE</tracking-mode>
     <session-timeout>120</session-timeout>
   </session-config>

5. Locate the Pentaho Web Context Filter.

6. Add this init-param:

   <init-param>
     <param-name>ssoEnabled</param-name>
     <param-value>true</param-value>
   </init-param>

7. Save the file.

8. Open pentaho-server/pentaho-solutions/system/applicationContext-spring-security-cas.xml.

9. Locate the httpSessionPentahoSessionContextIntegrationFilter bean.

10. Set ssoEnabled from true to false.

11. Save the file.

12. Restart the Pentaho Server.

When the session expires, users see a timeout dialog. Closing the dialog triggers CAS reauthentication.

Cannot change Administrator password in PUC

When you add an administrator account in the Pentaho User Console (PUC), you have:

• the default admin password

• a password for the additional administrator account

When you change the password for the additional administrator account, you might see an error. Enter the password of the currently signed-in administrator in Administrator password.

Change PUC Password dialog box

Snowflake logging errors

You might see this warning while connecting to Snowflake:

WARNING: Connect strings must start with jdbc:snowflake://

Pentaho 9.5 upgraded the Snowflake JDBC driver to 3.13.29 to address security concerns.

To resolve the warning, download Snowflake JDBC driver 3.13.30 from:

https://repo1.maven.org/maven2/net/snowflake/snowflake-jdbc/3.13.30/snowflake-jdbc-3.13.30.jar

Replace the existing JAR in:

pentaho-server/tomcat/webapps/pentaho/WEB-INF/lib/

Pentaho Server issues

Use these fixes for common Pentaho Server issues.

In this article

• Publishing a domain fails

• Library conflicts

• Accented characters in report parameters

• Duplicate vfs-provider.xml files

• Tomcat logs show memory leak warnings

• JTDS Windows domain authentication

• Enable JavaScriptAction (XAction)

• Amazon S3 authentication from the server

Publishing a domain to the Pentaho Server fails

If publishing a domain fails, confirm these statements are true:

• The Pentaho Server is running.

• Your user has the administrator role. The default is admin.

• The Web Publish URL and Domain Name have no leading slashes.

• The Web Publish URL and Domain Name have no trailing slashes.

Library conflicts

The Pentaho Server uses many third-party libraries.

Incompatible versions in the application server’s global lib folder can cause startup and runtime issues.

Pick library versions that match your environment.

These JARs are known to cause issues:

• commons-collections-3.2.jar (from Pentaho)

• jettison-1.01.jar (from Pentaho)

Report parameters with accented characters

If you run a report with accented characters in parameters, you might see:

This parameter value is of an invalid value.

Add UTF-8 URI encoding to Tomcat connectors.

1

Stop Tomcat

sudo /etc/init.d/tomcat stop

2

Update server.xml

Open /tomcat/server/conf/server.xml.

For each Connector element, add URIEncoding="UTF-8".

<Connector URIEncoding="UTF-8" port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443" />

3

Restart Tomcat

sudo /etc/init.d/tomcat start

VFS provider.xml duplicates

The vfs-provider.xml file can exist in multiple application JARs.

Multiple copies can cause classpath errors.

Merge the files into one canonical version.

Tomcat logs report memory leaks

When you shut down Tomcat, you might see SEVERE warnings like these:

Dec 17, 2010 10:18:19 AM org.apache.catalina.loader.WebappClassLoader clearReferencesJdbc
SEVERE: The web application [/pentaho] registered the JBDC driver [mondrian.olap4j.MondrianOlap4jDriver] but failed to unregister it when the web application was stopped. To prevent a memory leak, the JDBC Driver has been forcibly unregistered.
Dec 17, 2010 10:18:19 AM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/pentaho] appears to have started a thread named [HSQLDB Timer @49cf9f] but has failed to stop it. This is very likely to create a memory leak.
Dec 17, 2010 10:18:19 AM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/pentaho] appears to have started a thread named [MySQL Statement Cancellation Timer] but has failed to stop it. This is very likely to create a memory leak.
Dec 17, 2010 10:18:19 AM org.apache.catalina.loader.WebappClassLoader clearThreadLocalMap
SEVERE: The web application [/pentaho] created a ThreadLocal with key of type [java.lang.InheritableThreadLocal] (value [java.lang.InheritableThreadLocal@a1320e]) and a value of type [org.pentaho.platform.engine.security.session.TrustedSystemStartupSession] (value [org.pentaho.platform.engine.security.session.TrustedSystemStartupSession@111089b]) but failed to remove it when the web application was stopped. This is very likely to create a memory leak.

These messages can matter during restarts or redeployments.

Restart Tomcat instead of redeploying the web application.

Windows domains will not authenticate when using the JTDS driver

With the JTDS JDBC driver, Windows DOMAIN\\user syntax does not work in the URL.

Append the domain at the end of the URL with a semicolon.

jdbc:jtds:sqlserver://svn-devel.example.com:1533/reportsInProgress;domain=testdomain

Unable to run XAction when using the JavaScript component

JavaScriptAction runs arbitrary JavaScript code on the Pentaho Server.

Pentaho disables it by default.

Enable JavaScriptAction only if you understand the risk.

1

Stop the server

Stop the Pentaho Server if it is running.

2

Edit plugins.properties

Go to:

/tomcat/webapps/pentaho/WEB-INF/classes/org/pentaho/platform/engine/services/runtime

Open plugins.properties.

3

Uncomment JavaScriptAction entries

Remove the leading # from these lines:

# org.pentaho.component.JavascriptRule = !org.pentaho.platform.plugin.action.javascript.JavascriptRule
# JavascriptRule = org.pentaho.platform.plugin.action.javascript.JavascriptRule
# org.pentaho.plugin.javascript.JavascriptRule = !org.pentaho.platform.plugin.action.javascript.JavascriptRule

4

Restart the server

Restart the Pentaho Server.

PDI cannot access Amazon S3

When you access Amazon S3 from the Pentaho Server using the Amazon CLI, you might see authentication errors.

This often happens when the Pentaho Server and the PDI client run on different machines.

Use the same AWS service account for:

• Your Amazon CLI access to S3

• Your Pentaho Server login

Pentaho Repository issues

Use these troubleshooting tips for common Pentaho Repository issues.

• Unable to get list of repositories

• Importing and exporting PDI content with Pentaho 8.0 and earlier

Unable to get list of repositories

When you work with a repository and try to run a job or transformation remotely on a Carte server, you might see an error like this:

There was an error posting the transformation on the remote server:
   org.pentaho.di.core.exception.KettleException:
   Unable to get a list of repositories to locate repository 'repo'

To run a job or transformation remotely on a Carte server, copy the local repositories.xml file from the user's .kettle directory to the Carte server's $HOME/.kettle directory.

Carte also looks for repositories.xml in the directory where you started Carte.

Importing and exporting PDI content with Pentaho 8.0 and earlier

If you export repository contents from Pentaho 8.0 (or earlier) and import them into a later version, the import can fail.

This can happen if you export or import the entire repository. The export can include items in locations that later versions restrict.

To avoid the error, export and import specific items instead of the entire repository.

If you need multiple selections, export each selection separately.

You do not need to export Operations Mart (Ops Mart) content. It is included and updated automatically with each new Pentaho version.

Archived content

These topics are kept for backward compatibility.

Archived: JDBC driver issues (legacy text)

Before you begin troubleshooting suspected JDBC driver issues, make sure that the correct JDBC driver JARs are installed in the correct locations. You could install your drivers with our JDBC Distribution Tool to ensure they are placed in the correct locations. Also, make sure there are no conflicting driver versions installed. Confirm with your database or driver vendor if you suspect you have JDBC driver compatibility issues. See the Install Pentaho Data Integration and Analytics document for details.

The Pentaho Server needs the appropriate driver to connect to the database that stores your data. You can download drivers from your database vendor's website. Check the JDBC drivers reference in the Try Pentaho Data Integration and Analytics document for a list of supported drivers and links to vendor websites.

Perform the following steps to install the appropriate driver for your Pentaho Server:

1. Stop the Pentaho Server.

2. Copy your driver into this location: <pentaho-install-directory>/server/pentaho-server/tomcat/lib.

3. Start the Pentaho Server.

Archived: Data conversion issues with MySQL driver 5.0.8 (legacy text)

The MySQL JDBC driver version 5.0.8 may cause data conversion errors in the Pentaho Server. For example, SQL statements that convert a numeric field to a string are returned as a string in version 5.0.7, but return as a byte array in version 5.0.8.

To solve this problem, you must replace the mysql-connector-java-5.0.8.jar with the mysql-connector-java-5.0.7.jar in your client tool or application server's lib folder

Archived: Fixing JTDS varchar(Max) limitations in MSSQL 2005 (legacy text)

Creating a report that uses a column of type varchar(MAX) may result in a net.sourceforge.jtds.jdbc.ClobImpl@83cf00 error when using the JTDS SQL Server driver. This is caused by inherent limitations in older versions of the JTDS driver. Additionally, the SQL Server JDBC driver version 1.2.2828 also has issues accessing a varchar(MAX) column.

The solution is to upgrade the MSSQL 2005 JDBC driver to version 1.0.809.102 or later. Download and install the http://msdn.microsoft.com/en-us/sqlserver/aa937724 file from Microsoft.com, then restart your MSSQL server.