Skip to content

Troubleshooting Collibra Tag Sync

This page explains how to monitor tag sync and resolve common issues for the Collibra tag sync connector.

Monitoring tag sync

Use the Grafana dashboards and the PolicySync audit records to confirm a sync ran and to diagnose issues — these are the recommended ways to observe tag sync.

Grafana — Tag Sync Loader metrics

Open Grafana → Dashboards → Application-Dashboards → connectors → common → Connector-Common and find the Tag Sync Loader Metrics section. The panels report, per connector:

Panel What it shows What healthy looks like
Tag Count (Scanned) Distinct tags read from Collibra in the latest run Non-zero and stable; a sudden drop to 0 signals a Collibra/scan problem
Tag Resource Count Resources (tables/columns) that carry tags Tracks the size of your tagged estate
Delta Count Changes applied in the run (added + deleted) 0 at steady state; spikes when tags change in Collibra
Tag Sync Cycles (rate) Sync runs per second, by success/failure status A steady success rate; any failure series is a red flag
Tag Counter Over Time Cumulative sync cycles over time A rising line; flat means sync is not running
Time Taken to Load Tags Average time per sync cycle Stable; a steadily rising time means trouble before it fails

Each panel is tagged with connector and status (success / failure), so you can filter to the Collibra connector and separate healthy from failed runs.

PolicySync audit

The connector records a PolicySync audit entry for every sync run and for each tag definition it creates or deletes. Use the audit view in the Privacera portal to confirm activity without opening a shell on the pod:

  • A LOAD_TAG_SYNC activity entry per sync run, summarizing what changed (scanned rows, changed assets, tags added or deleted).
  • Per-tag create and delete audit events when tags are added to or removed from Ranger.

This is the quickest way to answer "did the last sync run, and what did it change?" and to review tag add/delete history over time.

What to look for

Signal Meaning
Sync cycles increasing with status=success Tag sync is running normally
Delta Count goes above 0 then back to 0 A change was detected and applied; steady state resumed
Tag Count (Scanned) drops to 0 unexpectedly Collibra returned nothing — a scan/connectivity problem; deletes are blocked by the safeguards
A status=failure series appears, or cycles stop increasing Sync is failing or paused (for example, the circuit breaker opened) — check Collibra health and connectivity

Common issues

Tags are not appearing in Ranger

  • Confirm both mapping properties are set and non-empty: collibra.connection.to.service.mapping and collibra.ranger.service.mapping. Tag sync does not run unless both are present.
  • Confirm the connection name in connection.to.service.mapping matches the Collibra connection name exactly (matching is case-sensitive).
  • Confirm the engine key used in connection.to.service.mapping also appears in ranger.service.mapping (every connection's engine must map to a Ranger service).
  • Confirm the target Ranger tag service (for example privacera_trino) exists.
  • Verify the Collibra service account can read the assets and their tags via the Collibra REST API.

A tag was removed in Collibra but still shows in Ranger

  • Check the PolicySync audit / Grafana for a rejected or incomplete scan. If the latest run shows status=failure or Tag Count (Scanned) dropped to 0, a safeguard rejected the scan and intentionally skipped deletes — fix the underlying Collibra connectivity/scan issue and the delete will apply on the next healthy run.
  • If the tag definition remains but its mapping is gone, the tag may still be mapped by another service or connector; Ranger refuses to delete a tag definition that is still in use elsewhere.

Tag sync appears paused

  • The circuit breaker opens after repeated scan failures (default after 3 consecutive failures) and stays open for a cooldown (default 300s). In Grafana this shows up as the Tag Sync Cycles failure series and cycles no longer increasing. Check Collibra health and connectivity, then wait for the cooldown or restart the connector after fixing the root cause.

Wrong resource level in Ranger

  • Confirm the connection's engine is correct. The resource hierarchy differs per engine:
    • Hive — database / table / column
    • Trino — catalog / schema / table / column
    • Snowflake — database / schema / table / column
  • A catalog whose name matches an engine key is auto-routed to that engine; if a catalog is being routed unexpectedly, check that its name does not collide with an engine key in ranger.service.mapping.