Apache Kudu Configuration Reference

block cache capacity in MB

Comma-separated list of NTP servers for the built-in NTP client, each in format <FQDN|IP>[:PORT]. This list will be used in one of the following cases: (A) the built-in NTP client is explicitly set as the time source (i.e. --time_source=builtin) (B) the 'auto' pseudo-source for time is used and the cloud instance detector isn’t aware about any preferred NTP servers provided by the environment.

The time source that HybridClock should use. Must be one of auto, builtin, system, system_unsync (toy clusters/testing only), mock (testing only). When set to auto, the system automatically picks one of the following depending on the environment: builtin, system, system_unsync, where in case of picking builtin the built-in NTP client is configured with dedicated NTP server(s) provided by the environment.

Whether the Log/WAL should explicitly call fsync() after each write.

Comma-separated list of directories with data blocks. If this is not specified, fs_wal_dir will be used as the sole data block directory.

Directory with metadata. If this is not specified, for compatibility with Kudu 1.6 and below, Kudu will check the first entry of fs_data_dirs for metadata and use it as the metadata directory if any exists. If none exists, fs_wal_dir will be used as the metadata directory.

Directory with write-ahead logs. If this is not specified, the program will not start. May be the same as fs_data_dirs

Comma-separated list of the RPC addresses belonging to all Masters in this cluster. NOTE: if not specified or a single address is specified, configures a non-replicated Master.

Path to the Kerberos Keytab file for this server. Specifying a keytab file will cause the server to kinit, and enable Kerberos to be used to authenticate RPC connections.

Comma-separated list of addresses to bind to for RPC connections. Currently, ephemeral ports (i.e. port 0) are not allowed.

The list of usernames to allow as super users, comma-separated. A '*' entry indicates that all authenticated users are allowed. If this is left unset or blank, the default behavior is that the identity of the daemon itself determines the superuser. If the daemon is logged in from a Keytab, then the local username from the Kerberos principal is used; otherwise, the local Unix username is used.

The list of usernames who may access the cluster, comma-separated. A '*' entry indicates that all authenticated users are allowed.

The location of the embedded webserver’s TLS/SSL certificate file, in PEM format. If empty, webserver TLS/SSL support is not enabled. If --webserver_private_key_file is set, this option must be set as well.

Port to bind to for the webserver

The full path to the private key used as a counterpart to the public key contained in --webserver_certificate_file. This flag must be set if the --webserver_certificate_file flag is set.

A Unix command whose output returns the password to decrypt the private key of the webserver’s certificate pointed to by the --webserver_private_key_file flag. If the PEM key file is not password-protected, this flag does not need to be set. Trailing whitespace will be trimmed before it is used to decrypt the private key

Require connections to the webserver to authenticate via Kerberos using SPNEGO.

Prefix of log filename - full path is <log_dir>/<log_filename>.[INFO|WARN|ERROR|FATAL]

Maximum number of log files to retain per severity level. The most recent log files are retained. If set to 0, all log files are retained.

Size of the maintenance manager thread pool. For spinning disks, the number of threads should not be above the number of devices.

Maximum amount of memory this daemon should use, in bytes. A value of 0 autosizes based on the total system memory. A value of -1 disables all memory limiting.

load flags from file

show help on all flags [tip: all flags can have two dashes]

show version and build info and exit

color messages logged to stderr (if supported by terminal)

If specified, logfiles are written into this directory instead of the default logging directory.

log messages go to stderr instead of logfiles

approx. maximum log file size (in MB). A value of 0 will be silently overridden to 1.

Kerberos principal that this daemon will log in as. The special token _HOST will be replaced with the FQDN of the local host.

Number of seconds to retain tablet history, including history required to perform diff scans and incremental backups. Reads initiated at a snapshot that is older than this age will be rejected. To disable history removal, set to -1.

Enables heap profiling for the lifetime of the process. Profile output will be stored in the directory specified by -heap_profile_path.

Output path to store heap profiles. If not set profiles are stored in /tmp/<process-name>.<pid>.<n>.heap.

Unlock flags marked as 'experimental'. These flags are not guaranteed to be maintained across releases of Kudu, and may enable features or behavior known to be unstable. Use at your own risk.

Unlock flags marked as 'unsafe'. These flags are not guaranteed to be maintained across releases of Kudu, and enable features or behavior known to be unsafe. Use at your own risk.

set flags from the environment [use 'export FLAGS_flag1=value']

set flags from the environment if present

comma-separated list of flag names that it is okay to specify on the command line even if the program does not define a flag with that name. IMPORTANT: flags in this list that have arguments MUST use the flag=value format

show help on modules whose name contains the specified substr

show help on the modules named by this flag value

show help on all modules in the main package

show help on only the main module for this program

produce an xml version of help

Put additional links to the log files in this directory

Prepend the log prefix to the start of each log line

Messages logged at a lower level than this don’t actually get logged anywhere

log messages at or above this level are copied to stderr in addition to logfiles. This flag obsoletes --alsologtostderr.

Stop attempting to log to disk if the disk is full.

Symbolize the stack trace in the tombstone

Show all VLOG(m) messages for m ⇐ this. Overridable by --vmodule.

per-module verbose level. Argument is a comma-separated list of <module name>=<log level>. <module name> is a glob pattern, matched against the filename base (that is, name ignoring .cc/.h./-inl.h). <log level> overrides any value given by --v.

Which type of block cache to use for caching data. Valid choices are 'DRAM' or 'NVM'. DRAM, the default, caches data in regular memory. 'NVM' caches data in a memory-mapped file using the memkind library. To use 'NVM', libmemkind 1.8.0 or newer must be available on the system; otherwise Kudu will crash.

Verify the checksum for each block on read if one exists

The default block size to use in cfiles

Default cfile block compression codec.

Write CRC32 checksums for each block

Maximum time in milliseconds that clients will cache tablet locations keyed by tablet ID.

Whether to show column attributes, including column encoding type, compression type, and default read/write value.

Whether to show column comment.

Whether to show column id.

Local address to bind client UDP socket used to send and receive NTP packets. The default value '0.0.0.0' is equivalent to '0.0.0.0:0' meaning 'bind to all available IPv4 interfaces using ephemeral ports (i.e. port 0)'. It might be useful to customize this flag if getting through a firewall to reach public NTP servers specified by --builtin_ntp_servers.

The time between successive polls of a single NTP server (in milliseconds)

Maximum allowed clock synchronization error as reported by NTP before the server will abort.

Amount of time in seconds to wait for clock synchronisation at startup. A value of zero means Kudu will fail to start if the clock is unsynchronized. This flag can prevent Kudu from crashing if it starts before NTP can synchronize the clock.

Should ineffective predicate filtering be disabled

Number of blocks to skip for every predicate effectiveness check

Rejection ratio below which predicate filter is considered ineffective

Name of the default database which is used in the Ranger authorization context when the database name is not specified in the table name. Ranger makes no difference between <ranger_default_database>.<table> and <table>, so privileges granted on <table> in <ranger_default_database> are applied to both <ranger_default_database>.<table> and <table> in Kudu.

Whether fsync() should be called when consensus metadata files are updated

Timeout used for all consensus internal RPC communications.

The maximum per-tablet RPC batch size when updating peers.

Seconds that a leader is unable to successfully heartbeat to a follower after which the follower is considered to be failed and evicted from the config.

Whether to use the server-wide file cache for WAL segments and WAL index chunks.

Maximum size of the group commit queue in bytes

The minimum number of past log segments to keep at all times, regardless of what is required for durability. Must be at least 1.

Server-wide version of 'log_cache_size_limit_mb'. The total memory used for caching log entries across all tablets is kept under this threshold.

The total per-tablet size of consensus entries which may be kept in memory. The log cache attempts to keep all entries which have not yet been replicated to all followers in memory, but if the total size of those entries exceeds this limit within an individual tablet, the oldest will be evicted.

Whether the WAL segments preallocation should happen asynchronously

Whether the WAL should preallocate the entire segment before writing to it

The default size for log segments, in MB

Whether to evict followers from the Raft config that have fallen too far behind the leader’s log to catch up normally or have been unreachable by the leader for longer than follower_unavailable_considered_failed_sec

Maximum heartbeat periods that the leader can fail to heartbeat in before we consider the leader to be failed. The total failure timeout in milliseconds is raft_heartbeat_interval_ms times leader_failure_max_missed_heartbeat_periods. The value passed to this flag may be fractional.

The heartbeat interval for Raft replication. The leader produces heartbeats to followers at this interval. The followers expect a heartbeat at this interval and consider a leader to have failed if it misses several in a row.

Whether to enable the advancement of "safe" time in the absense of write operations

TTL for the cached metric of the available disk space in the data directories, in seconds

Whether to consider available space when selecting a data directory during tablet or data block creation.

Number of bytes to reserve on each data directory filesystem for non-Kudu usage. The default, which is represented by -1, is that 1% of the disk space on each disk will be reserved. Any other value specified represents the number of bytes reserved and must be greater than or equal to 0. Explicit percentages to reserve are not currently supported

Maximum work thread per data directory.

Indicates the target number of data dirs to spread each tablet’s data across. If greater than the number of data dirs available, data will be striped across those available. A value of 0 indicates striping should occur across all healthy data dirs. Using fewer data dirs per tablet means a single drive failure will be less likely to affect a given tablet.

TTL for the cached metric of the available disk space in the WAL directories, in seconds

Which block manager to use for storage. Valid options are 'file', 'log' and 'logr'. The 'file' block manager is not suitable for production use due to scaling limitations.

Name of the cluster key that is used to encrypt server encryption keys as stored in Ranger KMS.

Key provider implementation to generate and decrypt server keys. Valid values are: 'default' (not for production usage), and 'ranger-kms'.

Number of bytes to reserve on the log directory filesystem for non-Kudu usage. The default, which is represented by -1, is that 1% of the disk space on each disk will be reserved. Any other value specified represents the number of bytes reserved and must be greater than or equal to 0. Explicit percentages to reserve are not currently supported

Comma-separated list of Ranger KMS server URLs. Must be set when 'encryption_key_provider' is set to 'ranger-kms'.

Additional fraction of a log container’s calculated size that must be consumed on disk before the container is considered to be inconsistent and subject to excess space cleanup at block manager startup.

Maximum number of blocks (soft) of a log container. Use 0 for no limit. Use -1 for no limit except in the case of a kernel bug with hole punching on ext4 (see KUDU-1508 for details).

Maximum size (soft) of a log container

Number of bytes to preallocate in a log container when creating new blocks. Set to 0 to disable preallocation

Configures the socket connect timeout, in seconds, for Thrift connections to the Hive Metastore.

The service principal of the Hive Metastore server. Must match the primary (user) portion of hive.metastore.kerberos.principal option in the Hive Metastore configuration.

Maximum size of Hive Metastore objects that can be received by the HMS client in bytes. Should match the metastore.server.max.message.size configuration.

Configures the socket receive timeout, in seconds, for Thrift connections to the Hive Metastore.

The number of times that HMS operations will retry after encountering retriable failures, such as network errors.

Configures whether Thrift connections to the Hive Metastore use SASL (Kerberos) security. Must match the value of the hive.metastore.sasl.enabled option in the Hive Metastore configuration. When enabled, the --keytab_file flag must be provided.

Configures the socket send timeout, in seconds, for Thrift connections to the Hive Metastore.

Address of the Hive Metastore instance(s). The provided port must be for the HMS Thrift service. If a port is not provided, defaults to 9083. If the HMS is deployed in an HA configuration, multiple comma-separated addresses should be supplied. If not set, the Kudu master will not send Kudu table catalog updates to Hive. The configured value must match the Hive hive.metastore.uris configuration.

Maximum number of threads to allow in each server-wide thread pool. If -1, Kudu will automatically calculate this value. It is an error to use a value of 0.

Comma-separated list of trusted users who may access the cluster without being authorized against fine-grained permissions.

How long to sleep in between auto leader rebalancing cycles, before checking the cluster again to see if there is leader skew and if run task again.

auto leader rebalancing send leader step down rpc timeout seconds

Whether to ignore rebalancing the soft deleted tables

Max count of leader transfer when every leader rebalance runs

How long to sleep in between rebalancing cycles, before checking the cluster again to see if there is skew and rebalancing to be done.

The threshold for the per-table location load imbalance. The threshold is used during the cross-location rebalancing phase. If the measured cross-location load imbalance for a table is greater than the specified threshold, the rebalancer tries to move table’s replicas to reduce the imbalance. The recommended range for the threshold is [0.5, …​) with the default value of 1.0. The threshold represents a policy wrt what to prefer: either ideal balance of the cross-location load on per-table basis (lower threshold value) or minimum number of replica movements between locations (greater threshold value). The default value is empirically proven to be a good choice between 'ideal' and 'good enough' replica distributions.

Maximum number of replica moves to perform concurrently on one tablet server: 'move from' and 'move to' are counted as separate move operations.

RPC timeout in seconds when making RPCs to request moving tablet replicas or to check if the replica movement has completed.

How long to wait before checking to see if the scheduled replica movement in this iteration of auto-rebalancing has completed.

Whether to split the tablet report data received from one tablet server into chunks when persisting it in the system catalog. The chunking starts at around the maximum allowed RPC size controlled by the --rpc_max_message_size flag. When the chunking is disabled, a tablet report sent by a tablet server is rejected if it would result in an oversized update on the system catalog tablet. With the default settings for --rpc_max_message_size, the latter can happen only in case of extremely high number of tablet replicas per tablet server.

Time in seconds to be reserved before purging a deleted table for the table from DeleteTable request. Value 0 means DeleteTable() works the regular way, i.e. dropping the table and purging its data immediately. If it’s set to anything greater than 0, then all DeleteTable() RPCs are turned into SoftDeleteTable(…​, FLAGS_default_deleted_table_reserve_seconds). NOTE : this flag make no sense for soft-delete function because the reserve_seconds has been specified by user while calling SoftDeleteTable.

Default number of replicas for tables that do not have the num_replicas set.

Whether to support range-specific hash schemas for tables.

Whether to use range aware replica placement for newly created tablets.

Timeout used for the master→TS async rpc calls.

Maximum length of the comment of a column.

The number of tablet replicas per TS that can be requested for a new table. If 0, no limit is enforced.

Maximum length of the name of a table owner.

Maximum length of the comment of a table.

Minimum number of replicas that may be specified when creating a table: this is to enforce the minimum replication factor for tables created in a Kudu cluster. For example, setting this flag to 3 enforces every new table to have at least 3 replicas for each of its tablets, so there cannot be a data loss when a single tablet server fails irrecoverably.

Capacity for the table locations cache (in MiB); a value of 0 means table locations are not be cached.

Maximum time in milliseconds which clients may cache table locations. New range partitions may not be visible to existing client instances until after waiting for the ttl period.

Timeout used by the master when attempting to create tablet replicas during table creation.

After this amount of time, the master will stop attempting to contact a tablet server in order to perform operations such as deleting a tablet.

Number of notification log entries which are retrieved from the Hive Metastore per batch when polling.

Amount of time the notification log listener waits between attempts to poll the Hive Metastore for catalog updates.

Interval (in seconds) to check whether there is any soft_deleted table with expired reservation period. Such tables will be purged and cannot be recalled after that.

A Unix command whose output returns the password to encrypt and decrypt the IPKI root CA private key.

A Unix command which takes a single argument, the IP address or hostname of a tablet server or client, and returns the location string for the tablet server. A location string begins with a / and consists of /-separated tokens each of which contains only characters from the set [a-zA-Z0-9_-.]. If the cluster is not using location awareness features this flag should not be set.

A Unix command whose output returns the password to encrypt and decrypt the token signing key

Whether Kudu Masters should automatically attempt to join existing an existing cluster, specified by the master addresses

The interval, in seconds, with which to retry checks to determine whether this Master should be added to a cluster.

The amount of time, in seconds, to use as a timeout when sending RPCs to add this Master to a cluster.

Whether masters assign locations to connecting clients. Setting this flag to 'false' makes masters assign locations only to tablet servers, not clients.

Whether the master supports adding/removing master servers dynamically.

The period of time that a Master can go without receiving a heartbeat from a tablet server before considering it unresponsive. Unresponsive servers are not selected when assigning replicas during table creation or re-replication.

The maximum retry time for generating encryption keys using the Ranger KMS client. The maximum effective time for adding a new account to Apache Ranger is about 30 seconds, and the retry time for using the client to generate the key should be greater than this value.

Path to directory containing Ranger client configuration. When set, Ranger integration is enabled, fine-grained access control is enforced, and clients are issued authorization tokens. In addition, both --ranger_java_path and --ranger_jar_path flags need to be set properly for Ranger integration to work.

Whether to crash the Master if the Ranger subprocess crashes.

Path to the JAR file containing the Ranger subprocess. If not specified, the default JAR file path is expected to be next to the master binary. It can be a colon-separated list of JARs. If it is, the paths are not verified and passed straight to Java.

Extra JVM arguments to be passed to the Ranger subprocess.

Path where the Java binary was installed. If the value isn’t an absolute path (e.g. 'java'), it will be evaluated using the Kudu user’s PATH. If not specified, $JAVA_HOME/bin/java is used. If $JAVA_HOME is not found, Kudu will attempt to find 'java' in the Kudu user’s PATH.

Directory in which to look for a kudu-ranger-subprocess-log4j2.properties file. If empty, will use the value of --log_dir. If such a file does not exist, a properties file will be created to honor Kudu’s logging configurations.

Log level to use in the Ranger Java subprocess. Supports "all", "trace", "debug", "info", "warn", "error", "fatal", and "off"

Whether to have the Ranger subprocess log to stdout.

Whether to overwrite any existing logging configuration file, if found.

Directory in which to create a fifo used to receive messages from the Ranger subprocess. Existing fifos at this path will be overwritten. If not specified, a fifo will be created in the --ranger_config_path directory.

Socket backlog parameter used when listening for RPC connections. This defines the maximum length to which the queue of pending TCP connections inbound to the RPC server may grow. The value might be silently capped by the system-level limit on the listened socket’s backlog. The value of -1 has the semantics of the longest possible queue with the length up to the system-level limit. If a connection request arrives when the queue is full, the client may receive an error. Higher values may help the server ride over bursts of new inbound connection requests.

Listening RPC socket’s statistics sampling frequency. With --rpc_listen_socket_stats_every_log2=N, the statistics are sampled every 2^N connection request by each acceptor thread. Set this flag to -1 to disable statistics collection on the listening RPC socket.

Whether to encrypt data transfer on RPC connections that stay within a single host. Encryption here is likely to offer no additional security benefit since only a local 'root' user could intercept the traffic, and wire encryption does not suitably protect against such an attacker.

The maximum number of cycles for which an RPC callback should be allowed to run without emitting a warning. (Advanced debugging option)

The duration in seconds after an outbound connection has gone idle before a TCP keepalive probe is sent to the peer. Set to 0 to disable TCP keepalive probes from being sent.

The maximum number of keepalive probes sent before declaring the remote end as dead. Effective only if --tcp_keepalive_probe_period_s is not 0.

The duration in seconds between successive keepalive probes from an outbound connection if the previous probes are not acknowledged. Effective only if --tcp_keepalive_probe_period_s is not 0.

Maximum amount of time, in milliseconds, the server "remembers" a client for the purpose of caching its responses. After this period without hearing from it, the client is no longer remembered and the memory occupied by its responses is reclaimed. Retries of requests older than 'remember_clients_ttl_ms' are treated as new ones.

Maximum amount of time, in milliseconds, the server "remembers" a response to a specific request for a client. After this period has elapsed, the response may have been garbage collected and the client might get a response indicating the request is STALE.

If true, dump all RPC traces at INFO level

Threshold (in milliseconds) above which a RPC is considered too long and its duration and method name are logged at INFO level. The time measured is between when a RPC is accepted and when its call handler completes.

A trusted subnet whitelist. If set explicitly, all unauthenticated or unencrypted connections are prohibited except the ones from the specified address blocks. Otherwise, private network (127.0.0.0/8, etc.) and local subnets of all local network interfaces will be used. Set it to '0.0.0.0/0' to allow unauthenticated/unencrypted connections from all remote IP addresses. However, if network access is not otherwise restricted by a firewall, malicious users may be able to gain unauthorized access.

The maximum size of a message that any RPC that the server will accept. Must be at least 1MB.

Absolute path to Kerberos keytab file for HTTP SPNEGO. If it is empty, --keytab_file flag will be used.

When enabled, use the system krb5 library to map Kerberos principal names to local (short) usernames. If not enabled, the first component of the principal will be used as the short name. For example, 'kudu/foo.example.com@EXAMPLE' will map to 'kudu'.

The default severity level to use when filtering the metrics, both in JSON and Prometheus formats. Valid choices are 'debug', 'info', and 'warn'. The levels are ordered and lower levels include the levels above them. This value can be overridden by passing the level query parameter to the '/metrics' endpoint when fetching metrics in JSON format.

The maximum number of bytes to display on the debug webserver’s log page

Whether to disable filter logic on the server side for test purpose.

Comma-separated list of addresses to advertise externally for RPC connections. Ephemeral ports (i.e. port 0) are not allowed. This should be configured when the locally bound RPC addresses specified in --rpc_bind_addresses are not externally resolvable, for example, if Kudu is deployed in a container.

Number of RPC acceptor threads for each bound address

Number of RPC worker threads to run

Default length of queue for incoming RPC requests

Interval seconds to GC tcmalloc memory, 0 means disabled.

Maximum number of connection negotiation threads.

Minimum number of connection negotiation threads.

Number of libev reactor threads to start.

Whether to require RPC connections to authenticate. Must be one of 'disabled', 'optional', or 'required'. If 'optional', authentication will be used when the remote end supports it. If 'required', connections which are not able to authenticate (because the remote end lacks support) are rejected. Secure clusters should use 'required'.

If an RPC connection from a client is idle for this amount of time, the server will disconnect the client. Setting this to any negative value keeps connections always alive.

Whether to require RPC connections to be encrypted. Must be one of 'disabled', 'optional', or 'required'. If 'optional', encryption will be used when the remote end supports it. If 'required', connections which are not able to use encryption (because the remote end lacks support) are rejected. If 'disabled', encryption will not be used, and RPC authentication (--rpc_authentication) must also be disabled as well. Secure clusters should use 'required'.

Timeout for negotiating an RPC connection, in milliseconds

A Unix command whose output returns the password used to decrypt the RPC server’s private key file specified in --rpc_private_key_file. If the .PEM key file is not password-protected, this flag does not need to be set. Trailing whitespace will be trimmed before it is used to decrypt the private key.

TLSv1.2 (and prior) cipher suite preferences to use for TLS-secured RPC connections. Uses the OpenSSL cipher preference list format for TLSv1.2 and prior TLS protocol versions, for customizing TLSv1.3 cipher suites see --rpc_tls_ciphersuites flag. See 'man (1) ciphers' for more information.

TLSv1.3 cipher suite preferences to use for TLS-secured RPC connections. Uses the OpenSSL TLSv1.3 ciphersuite format. See 'man (1) ciphers' for more information. This flag is effective only if Kudu is built with OpenSSL v1.1.1 or newer.

The minimum protocol version to allow when for securing RPC connections with TLS. May be one of 'TLSv1', 'TLSv1.1', 'TLSv1.2', 'TLSv1.3'.

Maximum number of open file descriptors. If 0, Kudu will automatically calculate this value. This is a soft limit

Whether to enable the web server on this daemon. NOTE: disabling the web server is also likely to prevent monitoring systems from properly capturing metrics.

Interval (in milliseconds) at which the server will dump its metrics to a local log file. The log files are located in the same directory as specified by the -log_dir flag. If this is not a positive value, then metrics logging will be disabled.

The webserver adds 'Cache-Control' HTTP header with this value to all responses.

The webserver adds the Content-Security-Policy header to response when enabled.

Whether to add 'includeSubDomains' directive into the 'Strict-Transport-Security' header when the latter is enabled. See --webserver_hsts_max_age_seconds’s description for details.

The time, in seconds, that a browser should remember that the webserver must only be accessed using HTTPS. The HTTP Strict Transport Security (HSTS) policy is implemented by adding a 'Strict-Transport-Security' header. If greater or equal to zero, a TLS-enabled webserver adds the HSTS header with corresponding 'max-age' setting to the response. If the setting is negative, the HSTS header is not present in the response. As an option, it is possible to add 'includeSubDomains' directive as specified by the --webserver_hsts_include_sub_domains flag. WARNING: once enabled, the HSTS policy affects everything at the node/domain, so any HTTP endpoint at the node/domain effectively becomes unreachable to the browser which has reached the embedded webserver at this node via HTTPS

The maximum length of a POST request that will be accepted by the embedded web server.

The webserver adds 'X-Content-Type-Options' HTTP header with this value to all responses.

The webserver will add an 'X-Frame-Options' HTTP header with this value to all responses. This can help prevent clickjacking attacks.

Comma-separated list of addresses to advertise externally for HTTP(S) connections. Ephemeral ports (i.e. port 0) are not allowed. This should be configured when the locally bound webserver address specified in --webserver_interface and --webserver_port are not externally resolvable, for example, if Kudu is deployed in a container.

Domain used for the authentication by the embedded webserver

Files under <webserver_doc_root> are accessible via the embedded webserver. Defaults to $KUDU_HOME/www, or if $KUDU_HOME is not set, disables the document root

If true, webserver may serve static files from the webserver_doc_root

Interface to start the embedded webserver on. If blank, the webserver binds to 0.0.0.0

Maximum number of threads to start for handling webserver requests

Location of .htpasswd file containing user names and hashed passwords for the authentication performed by the embedded webserver (NOTE: for better protection, consider configuring SPNEGO using the --webserver_require_spnego flag)

The cipher suite preferences to use for webserver HTTPS connections. Uses the OpenSSL cipher preference list format. See man (1) ciphers for more information.

The minimum protocol version to allow when for webserver HTTPS connections. May be one of 'TLSv1', 'TLSv1.1', or 'TLSv1.2'.

Interval in milliseconds at which Kudu will check the deadlines of in-flight calls to the subprocess

Maximum payload size for a message in protobuf format the subprocess server accepts from a subprocess (i.e. its child), in bytes, 0 means unlimited. If a subprocess sends a message with bigger payload than the specified limit, the server rejects the message and responds with AppStatusPB::IO_ERROR error code. This setting is not effective for messages in JSON format.

Number of threads that will be dedicated to reading responses from the inbound queue and returning to callers

Number of milliseconds between attempts to enqueue the request to the subprocess

Maximum size in bytes of the outbound request queue. This is best effort: if a single request is larger than this, it is still added to the queue

Maximum size in bytes of the inbound response queue. This is best effort: if a single request is larger than this, it is still added to the queue

Number of seconds a call to the subprocess is allowed to take before a timeout error is returned to the calling process

The minimum quality for a compaction to run. If a compaction does not improve the average height of DiskRowSets by at least this amount, the compaction will be considered ineligible.

The minimum number of REDO delta files containing only ancient DELETE operations to schedule a major delta compaction on them. A DELETE operation is considered ancient if it was applied more than --tablet_history_max_age_sec seconds ago. With the default setting, this behavior is effectively disabled; see KUDU-3619 for details.

Maximum amount of memory that may be consumed by all in-flight ops belonging to a particular tablet. When this limit is reached, new ops will be rejected and clients will be forced to retry them. If -1, op memory tracking is disabled.

Whether to enable 'DeletedRowsetGCOp' for ancient, fully deleted rowsets without live row count stats. This is used to release the storage space of ancient, fully deleted rowsets generated by Kudu clusters that do not have live row count stats. If live row count feature is already supported in your kudu cluster, just ignore this flag.

The ratio of data in ancient UNDO deltas to the total amount of data in all deltas across rowsets picked for rowset merge compaction used as a threshold to determine whether to run the operation when --rowset_compaction_ancient_delta_max_ratio is set to 'true'. If the ratio is greater than the threshold defined by this flag, CompactRowSetsOp operations are postponed until UndoDeltaBlockGCOp purges enough of ancient UNDO deltas.

Whether to check the ratio of data in ancient UNDO deltas against the threshold set by --rowset_compaction_ancient_delta_max_ratio before running rowset merge compaction. If the ratio of ancient data in UNDO deltas is greater than the threshold, postpone running CompactRowSetsOp until UndoDeltaBlockGCOp purges ancient data and the ratio drops below the threshold (NOTE: regardless of the setting, the effective value of this flag becomes 'false' if --enable_undo_delta_block_gc is set to 'false')

Block size of the bloom filters used for tablet keys.

Target false-positive rate (between 0 and 1) to size tablet key bloom filters. A lower false positive rate may reduce the number of disk seeks required in heavy insert workloads, at the expense of more space and RAM required for bloom filters.

Whether to enable garbage collection of fully deleted rowsets. Disabling deleted rowset garbage collection may increase disk space usage for workloads that involve a high number of deletes. Only deleted rowsets that are entirely considered ancient history (see --tablet_history_max_age_sec) are deleted.

The maximum number of milliseconds we will spend initializing UNDO delta blocks per invocation of UndoDeltaBlockGCOp. Existing delta blocks must be initialized once per process startup to determine when they can be deleted.

Amount of time Kudu will try to initialize a client with which to perform transaction commit tasks.

Op timeout used by the TxnSystemClient when making transactions-related RPCs to the TxnStatusManager.

Whether incompatible replica management schemes or unsupported PREPARE_REPLACEMENT_BEFORE_EVICTION feature flag by master are fatal

Interval at which the TS heartbeats to the master.

Maximum number of consecutive heartbeat failures until the Tablet Server backs off to the normal heartbeat interval, rather than retrying.

Timeout used for the TS→Master heartbeat RPCs.

Time interval in seconds of sending a incremental tablets report to delete the tombstoned replicas whose tablets had already been deleted. Turn off this by setting it to a value less than 0. If this interval is set to less than the heartbeat interval, the tablets report will only be sent at the heartbeat interval. And also, please set this interval less than the flag metadata_for_deleted_table_and_tablet_reserved_secs of master if enable_metadata_cleanup_for_deleted_tables_and_tablets is set true. Otherwise, the tombstoned tablets probably could not be deleted.

Number of milliseconds of inactivity allowed for a scanner before it may be expired

Whether to report on 'slow' scans at the /scans WebUI page and in the INFO log. If enabled, well performing full table scans and scans run by lazily-fetching clients may be reported as 'slow' depending on the --slow_scanner_threshold_ms setting.

Number of milliseconds for the threshold of slow scan.

Tablet server RPC client timeout for BeginTabletCopySession calls. Also used for EndTabletCopySession calls.

Number of threads per tablet copy session for downloading tablet data blocks.

Whether to support download superblock in batch automatically when it is very large.When superblock is small, it can be downloaded once a time.

Burst factor for tablet copy throttling. The maximum rate the throttler allows within a token refill period (100ms) equals burst factor multiply base rate. The default value is 1.0, which means the maximun rate is equals to --tablet_copy_throttler_bytes_per_sec.

Limit tablet copying speed. It limits the copying speed of all the tablets in one server for one session. The default value is 0, which means not limiting the speed. The unit is bytes/seconds

Amount of time without activity before a tablet copy session will expire, in seconds

The number of rows to batch for servicing scan requests.

The default size for batches of scan results

The maximum batch size that a client may request for scan results.

The maximum amount of time (in milliseconds) a scan at a snapshot is allowed to wait for safe time to advance or pending write operations to apply, even if the deadline of the scan request itself allows for waiting longer.

If set, the server will apply fine-grained access control rules to client RPCs.

Number of threads available to copy tablets from remote servers.

Number of threads available to delete tablets. If this is set to 0 (the default), then the number of delete threads will be set based on the number of data directories. If the data directories are on some very fast storage device such as SSD or a RAID array, it may make sense to manually tune this.

Number of threads available to open tablets during startup. If this is set to 0 (the default), then the number of bootstrap threads will be set based on the number of data directories. If the data directories are on some very fast storage device such as SSD or a RAID array, it may make sense to manually tune this.

Number of threads available to reload transaction status tablets in memory metadata. If this is set to 0 (the default), then the number of reload threads will be set based on the number of data directories. If the data directories are on some very fast storage device such as SSD or a RAID array, it may make sense to manually tune this.

Minimum amount of time in milliseconds between walks of the tablet map to update tablet state counts.

Number of threads available for transaction commit tasks.

Interval at which the tablet statistics should be updated. Should be greater than 'heartbeat_interval_ms'

The URL to fetch the identifier of an AWS instance

IP address/FQDN of the internal NTP server to use from within an AWS instance

The URL to fetch the identifier of an Azure instance

The URL to fetch the identifier of a GCE instance

IP address/FQDN of the internal NTP server to use from within a GCE instance

Timeout for HTTP/HTTPS requests to the instance metadata server (in milliseconds)

The URL to fetch metadata of an OpenStack instance via Nova metadata service. OpenStack Nova metadata server does not provide a separate URL to fetch instance UUID, at least with 12.0.0 (Liberty) release.

Path to a file that contains certificate(s) (in PEM format) to trust when Kudu establishes a TLS-protected connection to HTTP/HTTPS server (e.g., KMS service, JWKS server, etc.)

Whether sensitive files should be encrypted on the file system.

Encryption key length.

Use fsync(2) instead of fdatasync(2) for synchronizing dirty data to disk.

Period of time (in ms) between removing expired file cache descriptors

Disable core dumps when this process crashes.

Comma-separated list that controls redaction context. Supported options are 'all','log', and 'none'. If 'all' is specified, sensitive data (sensitive configuration flags and row data) will be redacted from the web UI as well as glog and error messages. If 'log' is specified, sensitive data will only be redacted from glog and error messages. If 'none' is specified, no redaction will occur.

The umask that will be used when creating files and directories. Permissions of top-level data directories will also be modified at start-up to conform to the given umask. Changing this value may enable unauthorized local users to read or modify data stored by Kudu.

The time in seconds for connection timed out when pulling JWKS from the specified URL.

The time in seconds to wait between downloading JWKS from the specified URL.

The minimum number of milliseconds a metric will be kept for after it is no longer active. (Advanced option)

Whether to enable minidump generation upon process crash or SIGUSR1. Currently only supported on Linux systems.

Maximum number of minidump files to keep per daemon. Older files are removed first. Set to 0 to keep all minidump files.

Directory to write minidump files to. This can be either an absolute path or a path relative to --log_dir. Each daemon will create an additional sub-directory to prevent naming conflicts and to make it easier to identify a crashing daemon. Minidump files contain crash-related information in a compressed format. Minidumps will be written when a daemon exits unexpectedly, for example on an unhandled exception or signal, or when a SIGUSR1 signal is sent to the process. Cannot be set to an empty value.

Size limit hint for minidump files in KB. If a minidump exceeds this value, then breakpad will reduce the stack memory it collects for each thread from 8KB to 2KB. However it will always include the full stack memory for the first 20 threads, including the thread that crashed.

Capacity of DNS resolver cache, in MiBytes. For each key, the cache stores records returned by getaddrinfo(). A value of 0 means the results of DNS name resolution are not cached.

TTL of records in the DNS resolver cache, in seconds.