How to find out the bad query that resulted into cluster restart?

Question

How do I find the query possibly from query console?

I know the time period.

It is not available in history dashboard as in history dashboard. I can see long running queries for the last 10 minutes only.

Perhaps if I could get the right URI exploring App-Serives or meters data?

Answer 1

If you want to see what queries were executed in Query Console, check the 8000_AccessLog.txt entries in that timeframe and look for POST to the /qconsole/endpoints/evaler.xqy endpoint.

For example:

::1 - admin [20/Jun/2020:18:51:34 -0400] "POST /qconsole/endpoints/evaler.xqy?qid=4765025502384248875&dbid=10248170186042536325&sid=11969990273495629802&crid=6539177331&querytype=xquery&action=eval&cache=1592693494327 HTTP/1.1" 200 226 "http://localhost:8000/qconsole/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"

Grab the qid (in the example above, it is 4765025502384248875

Then you can find that query in the App-Services database by constructing a URI with that ID:

doc("/queries/4765025502384248875.txt")

Answer 2

Method One:

1. Check the server restart timestamp in the $Logs/ErrorLog.txt
2. Assuming the original query was executed in qconsole, then get the $qid in the $Logs/8000_RequestLog.txt based on step 1 timestamps. e.g below $qid is 10831783099673334040

"url":"/qconsole/endpoints/evaler.xqy?qid=10831783099673334040&dbid=

3. Execute below XQuery against the App-Services database:

declare namespace qconsole="http://marklogic.com/appservices/qconsole";
declare function local:query-history($qid as xs:unsignedLong)
{
  for $doc in doc()
  where $doc/qconsole:history/qconsole:query[qconsole:id = $qid]
  return base-uri($doc)
};
local:query-history(10831783099673334040);

Above will retrieve the history URI(s) associated with the $qid. The history document(s) will give you a breakdown of the timestamp, content….etc qconsole history.

Method Two:

You can view the query history dropdown ( little clock ) in the qconsole as below. It gives you the timestamp and the query details.