Apache Kudu Configuration Reference

block cache capacity in MB

The NTP servers used by the built-in NTP client, in format <FQDN|IP>[:PORT]. These will only be used if the built-in NTP client is enabled (i.e. if setting --time_source=builtin).

The time source that HybridClock should use. Must be one of auto, builtin, system, system_unsync (toy clusters/testing only), mock (testing only). When set to auto, the system automatically picks one of the following depending on the environment: builtin, system, system_unsync, where in case of picking builtin the built-in NTP client is configured with dedicated NTP server(s) provided by the environment.

Whether the Log/WAL should explicitly call fsync() after each write.

Comma-separated list of directories with data blocks. If this is not specified, fs_wal_dir will be used as the sole data block directory.

Directory with metadata. If this is not specified, for compatibility with Kudu 1.6 and below, Kudu will check the first entry of fs_data_dirs for metadata and use it as the metadata directory if any exists. If none exists, fs_wal_dir will be used as the metadata directory.

Directory with write-ahead logs. If this is not specified, the program will not start. May be the same as fs_data_dirs

Comma-separated list of the RPC addresses belonging to all Masters in this cluster. NOTE: if not specified, configures a non-replicated Master.

Path to the Kerberos Keytab file for this server. Specifying a keytab file will cause the server to kinit, and enable Kerberos to be used to authenticate RPC connections.

Comma-separated list of addresses to bind to for RPC connections. Currently, ephemeral ports (i.e. port 0) are not allowed.

The list of usernames to allow as super users, comma-separated. A '*' entry indicates that all authenticated users are allowed. If this is left unset or blank, the default behavior is that the identity of the daemon itself determines the superuser. If the daemon is logged in from a Keytab, then the local username from the Kerberos principal is used; otherwise, the local Unix username is used.

The list of usernames who may access the cluster, comma-separated. A '*' entry indicates that all authenticated users are allowed.

The location of the debug webserver’s SSL certificate file, in PEM format. If empty, webserver SSL support is not enabled. If --webserver_private_key_file is set, this option must be set as well.

Port to bind to for the web server

The full path to the private key used as a counterpart to the public key contained in --webserver_certificate_file. If --webserver_certificate_file is set, this option must be set as well.

A Unix command whose output returns the password used to decrypt the Webserver’s certificate private key file specified in --webserver_private_key_file. If the PEM key file is not password-protected, this flag does not need to be set. Trailing whitespace will be trimmed before it is used to decrypt the private key

Require connections to the web server to authenticate via Kerberos using SPNEGO.

Prefix of log filename - full path is <log_dir>/<log_filename>.[INFO|WARN|ERROR|FATAL]

Size of the maintenance manager thread pool. For spinning disks, the number of threads should not be above the number of devices.

Maximum amount of memory this daemon should use, in bytes. A value of 0 autosizes based on the total system memory. A value of -1 disables all memory limiting.

load flags from file

show help on all flags [tip: all flags can have two dashes]

show version and build info and exit

color messages logged to stderr (if supported by terminal)

If specified, logfiles are written into this directory instead of the default logging directory.

log messages go to stderr instead of logfiles

approx. maximum log file size (in MB). A value of 0 will be silently overridden to 1.

Number of seconds to retain tablet history, including history required to perform diff scans and incremental backups. Reads initiated at a snapshot that is older than this age will be rejected. To disable history removal, set to -1.

Enables heap profiling for the lifetime of the process. Profile output will be stored in the directory specified by -heap_profile_path.

Output path to store heap profiles. If not set profiles are stored in /tmp/<process-name>.<pid>.<n>.heap.

Unlock flags marked as 'experimental'. These flags are not guaranteed to be maintained across releases of Kudu, and may enable features or behavior known to be unstable. Use at your own risk.

Unlock flags marked as 'unsafe'. These flags are not guaranteed to be maintained across releases of Kudu, and enable features or behavior known to be unsafe. Use at your own risk.

set flags from the environment [use 'export FLAGS_flag1=value']

set flags from the environment if present

comma-separated list of flag names that it is okay to specify on the command line even if the program does not define a flag with that name. IMPORTANT: flags in this list that have arguments MUST use the flag=value format

show help on modules whose name contains the specified substr

show help on the modules named by this flag value

show help on all modules in the main package

show help on only the main module for this program

produce an xml version of help

Put additional links to the log files in this directory

Prepend the log prefix to the start of each log line

Messages logged at a lower level than this don’t actually get logged anywhere

log messages at or above this level are copied to stderr in addition to logfiles. This flag obsoletes --alsologtostderr.

Stop attempting to log to disk if the disk is full.

Symbolize the stack trace in the tombstone

Show all VLOG(m) messages for m ⇐ this. Overridable by --vmodule.

per-module verbose level. Argument is a comma-separated list of <module name>=<log level>. <module name> is a glob pattern, matched against the filename base (that is, name ignoring .cc/.h./-inl.h). <log level> overrides any value given by --v.

Which type of block cache to use for caching data. Valid choices are 'DRAM' or 'NVM'. DRAM, the default, caches data in regular memory. 'NVM' caches data in a memory-mapped file using the memkind library. To use 'NVM', libmemkind 1.8.0 or newer must be available on the system; otherwise Kudu will crash.

Verify the checksum for each block on read if one exists

The default block size to use in cfiles

Default cfile block compression codec.

Write CRC32 checksums for each block

Local address to bind client UDP socket used to send and receive NTP packets. The default value '0.0.0.0' is equivalent to '0.0.0.0:0' meaning 'bind to all available IPv4 interfaces using ephemeral ports (i.e. port 0)'. It might be useful to customize this flag if getting through a firewall to reach public NTP servers specified by --builtin_ntp_servers.

The time between successive polls of a single NTP server (in milliseconds)

Maximum allowed clock synchronization error as reported by NTP before the server will abort.

Amount of time in seconds to wait for clock synchronisation at startup. A value of zero means Kudu will fail to start if the clock is unsynchronized. This flag can prevent Kudu from crashing if it starts before NTP can synchronize the clock.

Name of the default database which is used in the Ranger authorization context when the database name is not specified in the table name. Ranger makes no difference between <ranger_default_database>.<table> and <table>, so privileges granted on <table> in <ranger_default_database> are applied toboth <ranger_default_database>.<table> and <table> in Kudu.

Whether fsync() should be called when consensus metadata files are updated

Timeout used for all consensus internal RPC communications.

The maximum per-tablet RPC batch size when updating peers.

Seconds that a leader is unable to successfully heartbeat to a follower after which the follower is considered to be failed and evicted from the config.

Number of bytes to reserve on the log directory filesystem for non-Kudu usage. The default, which is represented by -1, is that 1% of the disk space on each disk will be reserved. Any other value specified represents the number of bytes reserved and must be greater than or equal to 0. Explicit percentages to reserve are not currently supported

Whether to use the server-wide file cache for WAL segments and WAL index chunks.

Maximum size of the group commit queue in bytes

The minimum number of past log segments to keep at all times, regardless of what is required for durability. Must be at least 1.

Server-wide version of 'log_cache_size_limit_mb'. The total memory used for caching log entries across all tablets is kept under this threshold.

The total per-tablet size of consensus entries which may be kept in memory. The log cache attempts to keep all entries which have not yet been replicated to all followers in memory, but if the total size of those entries exceeds this limit within an individual tablet, the oldest will be evicted.

Whether the WAL segments preallocation should happen asynchronously

Whether the WAL should preallocate the entire segment before writing to it

The default size for log segments, in MB

Whether to evict followers from the Raft config that have fallen too far behind the leader’s log to catch up normally or have been unreachable by the leader for longer than follower_unavailable_considered_failed_sec

Maximum heartbeat periods that the leader can fail to heartbeat in before we consider the leader to be failed. The total failure timeout in milliseconds is raft_heartbeat_interval_ms times leader_failure_max_missed_heartbeat_periods. The value passed to this flag may be fractional.

The heartbeat interval for Raft replication. The leader produces heartbeats to followers at this interval. The followers expect a heartbeat at this interval and consider a leader to have failed if it misses several in a row.

Whether to enable the advancement of "safe" time in the absense of write operations

Number of seconds we cache the available disk space in the block manager.

Whether to consider available space when selecting a data directory during tablet or data block creation.

Number of bytes to reserve on each data directory filesystem for non-Kudu usage. The default, which is represented by -1, is that 1% of the disk space on each disk will be reserved. Any other value specified represents the number of bytes reserved and must be greater than or equal to 0. Explicit percentages to reserve are not currently supported

Maximum work thread per data directory.

Indicates the target number of data dirs to spread each tablet’s data across. If greater than the number of data dirs available, data will be striped across those available. A value of 0 indicates striping should occur across all healthy data dirs. Using fewer data dirs per tablet means a single drive failure will be less likely to affect a given tablet.

Which block manager to use for storage. Valid options are 'file' and 'log'. The file block manager is not suitable for production use due to scaling limitations.

Additional fraction of a log container’s calculated size that must be consumed on disk before the container is considered to be inconsistent and subject to excess space cleanup at block manager startup.

Maximum number of blocks (soft) of a log container. Use 0 for no limit. Use -1 for no limit except in the case of a kernel bug with hole punching on ext4 (see KUDU-1508 for details).

Maximum size (soft) of a log container

Number of bytes to preallocate in a log container when creating new blocks. Set to 0 to disable preallocation

Configures the socket connect timeout, in seconds, for Thrift connections to the Hive Metastore.

The service principal of the Hive Metastore server. Must match the primary (user) portion of hive.metastore.kerberos.principal option in the Hive Metastore configuration.

Maximum size of Hive Metastore objects that can be received by the HMS client in bytes. Should match the metastore.server.max.message.size configuration.

Configures the socket receive timeout, in seconds, for Thrift connections to the Hive Metastore.

The number of times that HMS operations will retry after encountering retriable failures, such as network errors.

Configures whether Thrift connections to the Hive Metastore use SASL (Kerberos) security. Must match the value of the hive.metastore.sasl.enabled option in the Hive Metastore configuration. When enabled, the --keytab_file flag must be provided.

Configures the socket send timeout, in seconds, for Thrift connections to the Hive Metastore.

Address of the Hive Metastore instance(s). The provided port must be for the HMS Thrift service. If a port is not provided, defaults to 9083. If the HMS is deployed in an HA configuration, multiple comma-separated addresses should be supplied. If not set, the Kudu master will not send Kudu table catalog updates to Hive. The configured value must match the Hive hive.metastore.uris configuration.

Maximum number of threads to allow in each server-wide thread pool. If -1, Kudu will automatically calculate this value. It is an error to use a value of 0.

Comma-separated list of trusted users who may access the cluster without being authorized against fine-grained permissions.

How long to sleep in between rebalancing cycles, before checking the cluster again to see if there is skew and rebalancing to be done.

The threshold for the per-table location load imbalance. The threshold is used during the cross-location rebalancing phase. If the measured cross-location load imbalance for a table is greater than the specified threshold, the rebalancer tries to move table’s replicas to reduce the imbalance. The recommended range for the threshold is [0.5, …​) with the default value of 1.0. The threshold represents a policy wrt what to prefer: either ideal balance of the cross-location load on per-table basis (lower threshold value) or minimum number of replica movements between locations (greater threshold value). The default value is empirically proven to be a good choice between 'ideal' and 'good enough' replica distributions.

Maximum number of replica moves to perform concurrently on one tablet server: 'move from' and 'move to' are counted as separate move operations.

RPC timeout in seconds when making RPCs to request moving tablet replicas or to check if the replica movement has completed.

How long to wait before checking to see if the scheduled replica movement in this iteration of auto-rebalancing has completed.

Whether to split the tablet report data received from one tablet server into chunks when persisting it in the system catalog. The chunking starts at around the maximum allowed RPC size controlled by the --rpc_max_message_size flag. When the chunking is disabled, a tablet report sent by a tablet server is rejected if it would result in an oversized update on the system catalog tablet. With the default settings for --rpc_max_message_size, the latter can happen only in case of extremely high number of tablet replicas per tablet server.

Default number of replicas for tables that do not have the num_replicas set.

Timeout used for the master→TS async rpc calls.

Maximum length of the comment of a column

The number of tablet replicas per TS that can be requested for a new table. If 0, no limit is enforced.

Maximum time in milliseconds which clients may cache table locations. New range partitions may not be visible to existing client instances until after waiting for the ttl period.

Timeout used by the master when attempting to create tablet replicas during table creation.

After this amount of time, the master will stop attempting to contact a tablet server in order to perform operations such as deleting a tablet.

Number of notification log entries which are retrieved from the Hive Metastore per batch when polling.

Amount of time the notification log listener waits between attempts to poll the Hive Metastore for catalog updates.

A Unix command which takes a single argument, the IP address or hostname of a tablet server or client, and returns the location string for the tablet server. A location string begins with a / and consists of /-separated tokens each of which contains only characters from the set [a-zA-Z0-9_-.]. If the cluster is not using location awareness features this flag should not be set.

Whether masters assign locations to connecting clients. By default they do if the location assignment command is set, but setting this flag to 'false' makes masters assign locations only to tablet servers, not clients.

Whether Kudu will require database-level privileges to authorize ListTables requests. When set to false, table-level privileges are required for each table. ranger_config_path must not be set if this is set

The service name of the Kudu server. Must match the service name used for Kudu server of sentry.service.admin.group option in the Sentry server configuration.

Capacity for the authz cache, in MiBytes. The cache stores information received from Sentry. A value of 0 means Sentry responses will not be cached.

Maximum number of entries in the privileges cache to process in one pass of the periodic scrubbing task. A value of 0 means there is no limit, i.e. all expired entries, if any, are invalidated every time the scrubbing task runs. Note that the cache is locked while the scrubbing task is running.

The interval to run the periodic task that scrubs the privileges cache of expired entries. A value of 0 means expired entries are only evicted when inserting new entries into a full cache.

Factor of multiplication for the authz token validity interval defined by --authz_token_validity_seconds flag. The result of the multiplication of this factor and authz token validity defines the TTL of entries in the authz cache.

Configures the socket connect timeout, in seconds, for Thrift connections to the Sentry server.

The service principal of the Sentry server. Must match the primary (user) portion of sentry.service.server.principal option in the Sentry server configuration.

Maximum size of Sentry objects that can be received by the Sentry client in bytes. Must match the value of the sentry.policy.client.thrift.max.message.size option in the Sentry server configuration.

Configures the socket receive timeout, in seconds, for Thrift connections to the Sentry server.

The number of times that Sentry operations will retry after encountering retriable failures, such as network errors.

Comma-separated list of RPC addresses of the Sentry service(s). When set, Sentry integration is enabled, fine-grained access control is enforced in the master, and clients are issued authorization tokens. Must match the value of the sentry.service.client.server.rpc-addresses option in the Sentry server configuration.

Configures whether Thrift connections to the Sentry server use SASL (Kerberos) security. Must match the value of the ‘sentry.service.security.mode’ option in the Sentry server configuration.

Configures the socket send timeout, in seconds, for Thrift connections to the Sentry server.

Configures which server namespace the Kudu instance belongs to for defining server-level privileges in Sentry. Used to distinguish a particular Kudu cluster in case of a multi-cluster setup. Must match the value of the hive.sentry.server option in the HiveServer2 configuration, and the value of the --server_name in Impala configuration.

The period of time that a Master can go without receiving a heartbeat from a tablet server before considering it unresponsive. Unresponsive servers are not selected when assigning replicas during table creation or re-replication.

Path to directory containing Ranger client configuration. When set, Ranger integration is enabled, fine-grained access control is enforced, and clients are issued authorization tokens. In addition, both --ranger_java_path and --ranger_jar_path flags need to be set properly for Ranger integration to work. The --sentry_service_rpc_addresses flag, which enables Sentry integration, must not be set if this is enabled.

Path to the JAR file containing the Ranger subprocess. If not specified, the default JAR file path is expected to be next to the master binary.

Path where the Java binary was installed. If the value isn’t an absolute path (e.g. 'java'), it will be evaluated using the Kudu user’s PATH. If not specified, $JAVA_HOME/bin/java is used. If $JAVA_HOME is not found, Kudu will attempt to find 'java' in the Kudu user’s PATH.

Directory in which to look for a kudu-ranger-subprocess-log4j2.properties file. If empty, will use the value of --log_dir. If such a file does not exist, a properties file will be created to honor Kudu’s logging configurations.

Log level to use in the Ranger Java subprocess. Supports "all", "trace", "debug", "info", "warn", "error", "fatal", and "off"

Whether to have the Ranger subprocess log to stdout.

Whether to overwrite any existing logging configuration file, if found.

Directory in which to create a fifo used to receive messages from the Ranger subprocess. Existing fifos at this path will be overwritten. If not specified, a fifo will be created in the --ranger_config_path directory.

Socket backlog parameter used when listening for RPC connections. This defines the maximum length to which the queue of pending TCP connections inbound to the RPC server may grow. If a connection request arrives when the queue is full, the client may receive an error. Higher values may help the server ride over bursts of new inbound connection requests.

Whether to encrypt data transfer on RPC connections that stay within a single host. Encryption here is likely to offer no additional security benefit since only a local 'root' user could intercept the traffic, and wire encryption does not suitably protect against such an attacker.

The maximum number of cycles for which an RPC callback should be allowed to run without emitting a warning. (Advanced debugging option)

The duration in seconds after an outbound connection has gone idle before a TCP keepalive probe is sent to the peer. Set to 0 to disable TCP keepalive probes from being sent.

The maximum number of keepalive probes sent before declaring the remote end as dead. Effective only if --tcp_keepalive_probe_period_s is not 0.

The duration in seconds between successive keepalive probes from an outbound connection if the previous probes are not acknowledged. Effective only if --tcp_keepalive_probe_period_s is not 0.

Maximum amount of time, in milliseconds, the server "remembers" a client for the purpose of caching its responses. After this period without hearing from it, the client is no longer remembered and the memory occupied by its responses is reclaimed. Retries of requests older than 'remember_clients_ttl_ms' are treated as new ones.

Maximum amount of time, in milliseconds, the server "remembers" a response to a specific request for a client. After this period has elapsed, the response may have been garbage collected and the client might get a response indicating the request is STALE.

If true, dump all RPC traces at INFO level

Threshold (in milliseconds) above which a RPC is considered too long and its duration and method name are logged at INFO level. The time measured is between when a RPC is accepted and when its call handler completes.

A trusted subnet whitelist. If set explicitly, all unauthenticated or unencrypted connections are prohibited except the ones from the specified address blocks. Otherwise, private network (127.0.0.0/8, etc.) and local subnets of all local network interfaces will be used. Set it to '0.0.0.0/0' to allow unauthenticated/unencrypted connections from all remote IP addresses. However, if network access is not otherwise restricted by a firewall, malicious users may be able to gain unauthorized access.

The maximum size of a message that any RPC that the server will accept. Must be at least 1MB.

When enabled, use the system krb5 library to map Kerberos principal names to local (short) usernames. If not enabled, the first component of the principal will be used as the short name. For example, 'kudu/foo.example.com@EXAMPLE' will map to 'kudu'.

The default severity level to use when filtering the metrics. Valid choices are 'debug', 'info', and 'warn'. The levels are ordered and lower levels include the levels above them. This value can be overridden by passing the level query parameter to the '/metrics' endpoint.

The maximum number of bytes to display on the debug webserver’s log page

Comma-separated list of addresses to advertise externally for RPC connections. Ephemeral ports (i.e. port 0) are not allowed. This should be configured when the locally bound RPC addresses specified in --rpc_bind_addresses are not externally resolvable, for example, if Kudu is deployed in a container.

Number of RPC acceptor threads for each bound address

Number of RPC worker threads to run

Default length of queue for incoming RPC requests

Interval seconds to GC tcmalloc memory, 0 means disabled.

Maximum number of connection negotiation threads.

Minimum number of connection negotiation threads.

Number of libev reactor threads to start.

Whether to require RPC connections to authenticate. Must be one of 'disabled', 'optional', or 'required'. If 'optional', authentication will be used when the remote end supports it. If 'required', connections which are not able to authenticate (because the remote end lacks support) are rejected. Secure clusters should use 'required'.

If an RPC connection from a client is idle for this amount of time, the server will disconnect the client. Setting this to any negative value keeps connections always alive.

Whether to require RPC connections to be encrypted. Must be one of 'disabled', 'optional', or 'required'. If 'optional', encryption will be used when the remote end supports it. If 'required', connections which are not able to use encryption (because the remote end lacks support) are rejected. If 'disabled', encryption will not be used, and RPC authentication (--rpc_authentication) must also be disabled as well. Secure clusters should use 'required'.

Timeout for negotiating an RPC connection.

A Unix command whose output returns the password used to decrypt the RPC server’s private key file specified in --rpc_private_key_file. If the .PEM key file is not password-protected, this flag does not need to be set. Trailing whitespace will be trimmed before it is used to decrypt the private key.

The cipher suite preferences to use for TLS-secured RPC connections. Uses the OpenSSL cipher preference list format. See man (1) ciphers for more information.

The minimum protocol version to allow when for securing RPC connections with TLS. May be one of 'TLSv1', 'TLSv1.1', or 'TLSv1.2'.

Maximum number of open file descriptors. If 0, Kudu will automatically calculate this value. This is a soft limit

Whether to enable the web server on this daemon. NOTE: disabling the web server is also likely to prevent monitoring systems from properly capturing metrics.

Interval (in milliseconds) at which the server will dump its metrics to a local log file. The log files are located in the same directory as specified by the -log_dir flag. If this is not a positive value, then metrics logging will be disabled.

The maximum length of a POST request that will be accepted by the embedded web server.

The webserver will add an 'X-Frame-Options' HTTP header with this value to all responses. This can help prevent clickjacking attacks.

Comma-separated list of addresses to advertise externally for HTTP(S) connections. Ephemeral ports (i.e. port 0) are not allowed. This should be configured when the locally bound webserver address specified in --webserver_interface and --webserver_port are not externally resolvable, for example, if Kudu is deployed in a container.

Domain used for debug webserver authentication

Files under <webserver_doc_root> are accessible via the debug webserver. Defaults to $KUDU_HOME/www, or if $KUDU_HOME is not set, disables the document root

If true, webserver may serve static files from the webserver_doc_root

Interface to start debug webserver on. If blank, webserver binds to 0.0.0.0

Maximum number of threads to start for handling web server requests

(Optional) Location of .htpasswd file containing user names and hashed passwords for debug webserver authentication

The cipher suite preferences to use for webserver HTTPS connections. Uses the OpenSSL cipher preference list format. See man (1) ciphers for more information.

The minimum protocol version to allow when for webserver HTTPS connections. May be one of 'TLSv1', 'TLSv1.1', or 'TLSv1.2'.

Interval in milliseconds at which Kudu will check the deadlines of in-flight calls to the subprocess

Number of threads that will be dedicated to reading responses from the inbound queue and returning to callers

Number of milliseconds between attempts to enqueue the request to the subprocess

Maximum size in bytes of the outbound request queue. This is best effort: if a single request is larger than this, it is still added to the queue

Maximum size in bytes of the inbound response queue. This is best effort: if a single request is larger than this, it is still added to the queue

Number of seconds a call to the subprocess is allowed to take before a timeout error is returned to the calling process

The minimum quality for a compaction to run. If a compaction does not improve the average height of DiskRowSets by at least this amount, the compaction will be considered ineligible.

Block size of the bloom filters used for tablet keys.

Target false-positive rate (between 0 and 1) to size tablet key bloom filters. A lower false positive rate may reduce the number of disk seeks required in heavy insert workloads, at the expense of more space and RAM required for bloom filters.

Whether to enable garbage collection of fully deleted rowsets. Disabling deleted rowset garbage collection may increase disk space usage for workloads that involve a high number of deletes. Only deleted rowsets that are entirely considered ancient history (see --tablet_history_max_age_sec) are deleted.

The maximum number of milliseconds we will spend initializing UNDO delta blocks per invocation of UndoDeltaBlockGCOp. Existing delta blocks must be initialized once per process startup to determine when they can be deleted.

Maximum amount of memory that may be consumed by all in-flight transactions belonging to a particular tablet. When this limit is reached, new transactions will be rejected and clients will be forced to retry them. If -1, transaction memory tracking is disabled.

Whether incompatible replica management schemes or unsupported PREPARE_REPLACEMENT_BEFORE_EVICTION feature flag by master are fatal

Interval at which the TS heartbeats to the master.

Maximum number of consecutive heartbeat failures until the Tablet Server backs off to the normal heartbeat interval, rather than retrying.

Timeout used for the TS→Master heartbeat RPCs.

Number of milliseconds of inactivity allowed for a scannerbefore it may be expired

Tablet server RPC client timeout for BeginTabletCopySession calls. Also used for EndTabletCopySession calls.

Amount of time without activity before a tablet copy session will expire, in seconds

The number of rows to batch for servicing scan requests.

The default size for batches of scan results

The maximum batch size that a client may request for scan results.

The maximum amount of time (in milliseconds) we’ll hang a scanner thread waiting for safe time to advance or transactions to commit, even if its deadline allows waiting longer.

If set, the server will apply fine-grained access control rules to client RPCs.

Number of threads available to copy tablets from remote servers.

Number of threads available to delete tablets. If this is set to 0 (the default), then the number of delete threads will be set based on the number of data directories. If the data directories are on some very fast storage device such as SSD or a RAID array, it may make sense to manually tune this.

Number of threads available to open tablets during startup. If this is set to 0 (the default), then the number of bootstrap threads will be set based on the number of data directories. If the data directories are on some very fast storage device such as SSD or a RAID array, it may make sense to manually tune this.

Minimum amount of time in milliseconds between walks of the tablet map to update tablet state counts.

Interval at which the tablet statistics should be updated.Should be greater than 'heartbeat_interval_ms'

The URL to fetch the identifier of an AWS instance

IP address/FQDN of the internal NTP server to use from within an AWS instance

The URL to fetch the identifier of an Azure instance

The URL to fetch the identifier of a GCE instance

IP address/FQDN of the internal NTP server to use from within a GCE instance

Timeout for HTTP/HTTPS requests to the instance metadata server (in milliseconds)

The URL to fetch metadata of an OpenStack instance via Nova metadata service. OpenStack Nova metadata server does not provide a separate URL to fetch instance UUID, at least with 12.0.0 (Liberty) release.

Use fsync(2) instead of fdatasync(2) for synchronizing dirty data to disk.

Period of time (in ms) between removing expired file cache descriptors

Disable core dumps when this process crashes.

Enable heap occupancy sampling. If this flag is set to some positive value N, a memory allocation will be sampled approximately every N bytes. Lower values of N incur larger overhead but give more accurate results. A value such as 512KB is a reasonable choice with relatively low overhead.

Comma-separated list that controls redaction context. Supported options are 'all','log', and 'none'. If 'all' is specified, sensitive data (sensitive configuration flags and row data) will be redacted from the web UI as well as glog and error messages. If 'log' is specified, sensitive data will only be redacted from glog and error messages. If 'none' is specified, no redaction will occur.

The umask that will be used when creating files and directories. Permissions of top-level data directories will also be modified at start-up to conform to the given umask. Changing this value may enable unauthorized local users to read or modify data stored by Kudu.

The minimum number of milliseconds a metric will be kept for after it is no longer active. (Advanced option)

Whether to enable minidump generation upon process crash or SIGUSR1. Currently only supported on Linux systems.

Maximum number of minidump files to keep per daemon. Older files are removed first. Set to 0 to keep all minidump files.

Directory to write minidump files to. This can be either an absolute path or a path relative to --log_dir. Each daemon will create an additional sub-directory to prevent naming conflicts and to make it easier to identify a crashing daemon. Minidump files contain crash-related information in a compressed format. Minidumps will be written when a daemon exits unexpectedly, for example on an unhandled exception or signal, or when a SIGUSR1 signal is sent to the process. Cannot be set to an empty value.

Size limit hint for minidump files in KB. If a minidump exceeds this value, then breakpad will reduce the stack memory it collects for each thread from 8KB to 2KB. However it will always include the full stack memory for the first 20 threads, including the thread that crashed.

Capacity of DNS resolver cache, in MiBytes. For each key, the cache stores records returned by getaddrinfo(). A value of 0 means the results of DNS name resolution are not cached.

TTL of records in the DNS resolver cache, in seconds.

The maximum number of threads to use for async DNS resolution

The path at which the NVM cache will try to allocate its memory. This can be a tmpfs or ramfs for testing purposes.

A ratio to set the usage of nvm cache. The charge of an item in the nvm cache is equal to the results of memkind_malloc_usable_size multiplied by the ratio.

Percentage of the hard memory limit that this daemon may consume before memory throttling of writes begins. The greater the excess, the higher the chance of throttling. In general, a lower soft limit leads to smoother write latencies but decreased throughput, and vice versa for a higher soft limit.

Percentage of the hard memory limit that this daemon may consume before WARNING level messages are periodically logged.

Percentage of the hard memory limit that this daemon may consume before flushing of in-memory data becomes prioritized.

Maximum percentage of the RSS that tcmalloc is allowed to use for reserved but unallocated memory.

Drop in-memory buffers of log contents. Logs can grow very quickly and they are rarely read before they need to be evicted from memory. Instead, drop them from memory as soon as they are flushed to disk.

Emit a backtrace when logging at file:linenum.

Buffer log messages logged at this level or lower (-1 means don’t buffer; 0 means buffer INFO only; …​)

Buffer log messages for at most this many seconds

Log file mode/permissions.

block cache capacity in MB

The NTP servers used by the built-in NTP client, in format <FQDN|IP>[:PORT]. These will only be used if the built-in NTP client is enabled (i.e. if setting --time_source=builtin).

The time source that HybridClock should use. Must be one of auto, builtin, system, system_unsync (toy clusters/testing only), mock (testing only). When set to auto, the system automatically picks one of the following depending on the environment: builtin, system, system_unsync, where in case of picking builtin the built-in NTP client is configured with dedicated NTP server(s) provided by the environment.

Whether the Log/WAL should explicitly call fsync() after each write.

Comma-separated list of directories with data blocks. If this is not specified, fs_wal_dir will be used as the sole data block directory.

Directory with metadata. If this is not specified, for compatibility with Kudu 1.6 and below, Kudu will check the first entry of fs_data_dirs for metadata and use it as the metadata directory if any exists. If none exists, fs_wal_dir will be used as the metadata directory.

Directory with write-ahead logs. If this is not specified, the program will not start. May be the same as fs_data_dirs

Path to the Kerberos Keytab file for this server. Specifying a keytab file will cause the server to kinit, and enable Kerberos to be used to authenticate RPC connections.

Comma-separated list of addresses to bind to for RPC connections. Currently, ephemeral ports (i.e. port 0) are not allowed.

The list of usernames to allow as super users, comma-separated. A '*' entry indicates that all authenticated users are allowed. If this is left unset or blank, the default behavior is that the identity of the daemon itself determines the superuser. If the daemon is logged in from a Keytab, then the local username from the Kerberos principal is used; otherwise, the local Unix username is used.

The list of usernames who may access the cluster, comma-separated. A '*' entry indicates that all authenticated users are allowed.

The location of the debug webserver’s SSL certificate file, in PEM format. If empty, webserver SSL support is not enabled. If --webserver_private_key_file is set, this option must be set as well.

Port to bind to for the web server

The full path to the private key used as a counterpart to the public key contained in --webserver_certificate_file. If --webserver_certificate_file is set, this option must be set as well.

A Unix command whose output returns the password used to decrypt the Webserver’s certificate private key file specified in --webserver_private_key_file. If the PEM key file is not password-protected, this flag does not need to be set. Trailing whitespace will be trimmed before it is used to decrypt the private key

Require connections to the web server to authenticate via Kerberos using SPNEGO.

Comma separated addresses of the masters which the tablet server should connect to. The masters do not read this flag — configure the masters separately using 'rpc_bind_addresses'.

Prefix of log filename - full path is <log_dir>/<log_filename>.[INFO|WARN|ERROR|FATAL]

Size of the maintenance manager thread pool. For spinning disks, the number of threads should not be above the number of devices.

Maximum amount of memory this daemon should use, in bytes. A value of 0 autosizes based on the total system memory. A value of -1 disables all memory limiting.

load flags from file

show help on all flags [tip: all flags can have two dashes]

show version and build info and exit

color messages logged to stderr (if supported by terminal)

If specified, logfiles are written into this directory instead of the default logging directory.

log messages go to stderr instead of logfiles

approx. maximum log file size (in MB). A value of 0 will be silently overridden to 1.

Number of seconds to retain tablet history, including history required to perform diff scans and incremental backups. Reads initiated at a snapshot that is older than this age will be rejected. To disable history removal, set to -1.

Enables heap profiling for the lifetime of the process. Profile output will be stored in the directory specified by -heap_profile_path.

Output path to store heap profiles. If not set profiles are stored in /tmp/<process-name>.<pid>.<n>.heap.

Unlock flags marked as 'experimental'. These flags are not guaranteed to be maintained across releases of Kudu, and may enable features or behavior known to be unstable. Use at your own risk.

Unlock flags marked as 'unsafe'. These flags are not guaranteed to be maintained across releases of Kudu, and enable features or behavior known to be unsafe. Use at your own risk.

set flags from the environment [use 'export FLAGS_flag1=value']

set flags from the environment if present

comma-separated list of flag names that it is okay to specify on the command line even if the program does not define a flag with that name. IMPORTANT: flags in this list that have arguments MUST use the flag=value format

show help on modules whose name contains the specified substr