How can I solve the problem ?
Thank you !
[root@only144 splunk]# netstat -antpl | grep 8089
tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN 22068/splunkd
tcp 0 0 127.0.0.1:8089 127.0.0.1:53208 TIME_WAIT -
tcp 0 0 127.0.0.1:8089 127.0.0.1:53206 TIME_WAIT -
[root@only144 splunk]# tail -f var/log/splunk/web_service.log
2012-08-08 16:54:57,260 INFO [50222961417fde7c0ccd10] cached:77 - memoized decorator used on function
2012-08-08 16:54:58,070 ERROR [50222961417fde7c0ccd10] config:81 - [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 79, in getServerZoneInfo
return times.getServerZoneinfo()
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/times.py", line 158, in getServerZoneinfo
serverStatus, serverResp = splunk.rest.simpleRequest('/search/timeparser/tz')
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init.py", line 436, in simpleRequest
raise splunk.AuthorizationFailed(extendedMessages=uri)
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
2012-08-08 16:54:58,087 ERROR [50222961417fde7c0ccd10] init:267 - Mako failed to render:
Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/init.py", line 265, in render_template
return templateInstance.render(*template_args)
File "/opt/splunk/lib/python2.7/site-packages/mako/template.py", line 283, in render
return runtime.render(self, self.callable, args, data)
File "/opt/splunk/lib/python2.7/site-packages/mako/runtime.py", line 575, in _render
*kwargs_for_callable(callable, data))
File "/opt/splunk/lib/python2.7/site-packages/mako/runtime.py", line 607, in render_context
_exec_template(inherit, lclcontext, args=args, kwargs=kwargs)
File "/opt/splunk/lib/python2.7/site-packages/mako/runtime.py", line 633, in _exec_template
callable(context, *args, **kwargs)
File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 10, in render_body
<%self:render/>
File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 25, in render_render
##
File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 67, in render_pagedoc
% else:
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 103, in getConfig
args.update(get_app_config(namespace))
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 48, in _get_app_config
rawConfig = splunk.bundle.getConf('app', namespace=app)
File "/opt/splunk/lib/python2.7/site-packages/splunk/bundle.py", line 39, in getConf
serverResponse, serverContent = rest.simpleRequest(uri, getargs={'fillcontents':1}, sessionKey=sessionKey)
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init_.py", line 436, in simpleRequest
raise splunk.AuthorizationFailed(extendedMessages=uri)
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/admin/search/properties/app?fillcontents=1
2012-08-08 16:54:58,089 WARNING [50222961417fde7c0ccd10] init:259 - unable to obtain template=dashboard.html
^C
[root@only144 splunk]# cat > var/log/splunk/web_service.log
^C
[root@only144 splunk]# tail -f var/log/splunk/web_service.log
2012-08-08 16:55:41,046 INFO [5022298d0b7fde889668d0] cached:77 - memoized decorator used on function
2012-08-08 16:55:41,859 ERROR [5022298d0b7fde889668d0] config:81 - [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 79, in getServerZoneInfo
return times.getServerZoneinfo()
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/times.py", line 158, in getServerZoneinfo
serverStatus, serverResp = splunk.rest.simpleRequest('/search/timeparser/tz')
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init.py", line 436, in simpleRequest
raise splunk.AuthorizationFailed(extendedMessages=uri)
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
2012-08-08 16:55:41,875 ERROR [5022298d0b7fde889668d0] init:267 - Mako failed to render:
Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/init.py", line 265, in render_template
return templateInstance.render(*template_args)
File "/opt/splunk/lib/python2.7/site-packages/mako/template.py", line 283, in render
return runtime.render(self, self.callable, args, data)
File "/opt/splunk/lib/python2.7/site-packages/mako/runtime.py", line 575, in _render
*kwargs_for_callable(callable, data))
File "/opt/splunk/lib/python2.7/site-packages/mako/runtime.py", line 607, in render_context
_exec_template(inherit, lclcontext, args=args, kwargs=kwargs)
File "/opt/splunk/lib/python2.7/site-packages/mako/runtime.py", line 633, in _exec_template
callable(context, *args, **kwargs)
File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 10, in render_body
<%self:render/>
File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 25, in render_render
##
File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 67, in render_pagedoc
% else:
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 103, in getConfig
args.update(get_app_config(namespace))
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 48, in _get_app_config
rawConfig = splunk.bundle.getConf('app', namespace=app)
File "/opt/splunk/lib/python2.7/site-packages/splunk/bundle.py", line 39, in getConf
serverResponse, serverContent = rest.simpleRequest(uri, getargs={'fillcontents':1}, sessionKey=sessionKey)
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init_.py", line 436, in simpleRequest
raise splunk.AuthorizationFailed(extendedMessages=uri)
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/admin/search/properties/app?fillcontents=1
2012-08-08 16:55:41,877 WARNING [5022298d0b7fde889668d0] init:259 - unable to obtain template=dashboard.html
The above helped me fix my problem as well. The role that the affected user was mapped to is supposed to inherit the base user account and tack on a few extra things. However, the inherited role went missing for reasons I'm still not clear on.
I had to edit $SPLUNK_HOME/etc/system/local/authorize.conf and re-add "importRoles = user" into the custom role I had, and that seems to have fixed the issue.
This solved the problem. My admin was attempting to login with an account that had ONLY the can_delete role. This role has only the delete_by_keyword permission, which won't be enough to view pages (it's missing the rest_properties_get priv that is mentioned above). We logged in with an account that had both admin and can_delete and everything worked fine.
Oh. I have seen this error appear when the user is missing a key capability as well. However I'm pretty sure it had no relation to can_delete
. Are you sure there aren't some other capabilities missing from the relevant role? And that can_delete
is a red herring? I actually ran into this a few weeks ago and had to do binary-search debugging, adding half the capabilities back, restarting and testing, etc.... It was something weird like authorize.conf had turned off the rest_properties_get
capability....
It appears the solution Nick posted below might not help in my case - for me, all views work fine unless the user has the "can_delete" permissions. If the user has can_delete, however, ALL views throw this error message. So the best I can guess is that it has something to do with the permissions for that particular role, but I'm not sure where to begin looking.
There's a lot of disparate things that can trigger this error, and I know that at least some of them actually write nothing relevant to web_service.log. The best advice I can give is to back out changes on that view until it starts working again.
The one I can remember offhand, is one I've seen a few times, which is if you forget to have the <list>
nodes around certain array-valued params, it'll give you this unhelpful error (and write nothing to web_service.log)
eg: In this simple statically defined Pulldown module, I've forgotten to put the little <list>
nodes around the label and value in the staticOptions
param. This will trigger the same error you're seeing.
<module name="Pulldown">
<param name="name">user</param>
<param name="label">User</param>
<param name="staticOptions">
<param name="label">Choose...</param>
<param name="value"></param>
</param>
So while it might have to do with some of the stuff in your log, it also might just be easier to do 'binary search debugging' on the view itself to figure out what it doesn't like -- delete half the view, but keep the markup valid, then hit /debug/refresh, then test. repeat, adding back deleted XML or deleting half of the remaining code as necessary until you get down to one line as the root-cause. It seems tedious but it'll give you the definitive cause of your bug in fewer than ten iterations.
What is the action the triggers this error? Is this error showing up in the user interface or when you go to a certain page or is this only noticed in the logs?
Bump. Having the same errors, and would like to know if there's a resolution.
Were you able to find the problem? Getting pretty much the same errors here.