Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jonathan_cooper
jonathan_cooper
Communicator
Member since:
09-17-2012
06-05-2020
Community Statistics
| Posts | 49 |
| Solutions | 6 |
| Karma Given | 13 |
| Karma Received | 32 |
| Member Since | 09-17-2012 |
Activity Feed
- Karma Re: Splunk DB Connect 2: Why does the RPC Service go through a restart loop in a Splunk 6.4 search head cluster? for jcoates_splunk. 06-05-2020 12:48 AM
- Karma Re: Splunk Add-on for Nessus Tenable API: Getting error "Fail to decrypt the encrypted credential information - not well-formed (invalid token)"? for jbailey_splunk. 06-05-2020 12:48 AM
- Karma Does the Splunk App for ServiceNow make a secure DB connection? for dflodstrom. 06-05-2020 12:48 AM
- Got Karma for Splunk Add-on for Nessus Tenable API: Getting error "Fail to decrypt the encrypted credential information - not well-formed (invalid token)"?. 06-05-2020 12:48 AM
- Got Karma for Re: How to deploy self-signed certs to deployment clients using the deployment server. 06-05-2020 12:48 AM
- Got Karma for Re: How to deploy self-signed certs to deployment clients using the deployment server. 06-05-2020 12:48 AM
- Got Karma for Re: How to deploy self-signed certs to deployment clients using the deployment server. 06-05-2020 12:48 AM
- Got Karma for Re: Does a universal forwarder's persistent queue exist after a reboot?. 06-05-2020 12:48 AM
- Got Karma for Re: Does a universal forwarder's persistent queue exist after a reboot?. 06-05-2020 12:48 AM
- Got Karma for Re: Does a universal forwarder's persistent queue exist after a reboot?. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-on for Nessus Tenable API: Getting error "Fail to decrypt the encrypted credential information - not well-formed (invalid token)"?. 06-05-2020 12:48 AM
- Got Karma for Splunk Add-on for Nessus Tenable API: Getting error "Fail to decrypt the encrypted credential information - not well-formed (invalid token)"?. 06-05-2020 12:48 AM
- Got Karma for Splunk Add-on for Nessus Tenable API: Getting error "Fail to decrypt the encrypted credential information - not well-formed (invalid token)"?. 06-05-2020 12:48 AM
- Got Karma for Splunk Add-on for Nessus Tenable API: Getting error "Fail to decrypt the encrypted credential information - not well-formed (invalid token)"?. 06-05-2020 12:48 AM
- Got Karma for Splunk Add-on for Nessus Tenable API: Getting error "Fail to decrypt the encrypted credential information - not well-formed (invalid token)"?. 06-05-2020 12:48 AM
- Got Karma for Splunk Add-on for Nessus Tenable API: Getting error "Fail to decrypt the encrypted credential information - not well-formed (invalid token)"?. 06-05-2020 12:48 AM
- Got Karma for Splunk Add-on for Nessus Tenable API: Getting error "Fail to decrypt the encrypted credential information - not well-formed (invalid token)"?. 06-05-2020 12:48 AM
- Got Karma for Splunk Add-on for Nessus Tenable API: Getting error "Fail to decrypt the encrypted credential information - not well-formed (invalid token)"?. 06-05-2020 12:48 AM
- Got Karma for Splunk Add-on for Nessus Tenable API: Getting error "Fail to decrypt the encrypted credential information - not well-formed (invalid token)"?. 06-05-2020 12:48 AM
- Karma Re: Securing communcation between Universal Forwarder and Heavy Forwarder for dwaddle. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 9 | |||
| 0 | |||
| 7 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 |
12-22-2016
08:26 AM
Looks like the app says it's supposed to be in JSON format. Is that not the case?
... View more
12-05-2016
11:43 AM
3 Karma
Totally doable from a deployment app, and you are able to set the path to the cert files in that deployment app as well, so you won't have to move the certs anywhere (via updated server.conf). I have done this at a few customer sites and it works well.
One thing to keep in mind is to ensure that the "sslVerifyServerCert" in deploymentclient.conf is set to false so that new UF's coming online can still contact the DS and get their new certs/apps. Another parameter to keep in mind is "requireClientCert" in server.conf. Default is set to false, but if set to true brand new UF's would need the certs and server.conf before hand in order to work.
You can always hit me up on email if you need more info, but totally doable.
... View more
09-07-2016
01:42 PM
I had another consultant get a Jira ticket opened internally, I'll see if I can get a status
... View more
08-25-2016
08:11 AM
Unaccepted just because I'm still having on-going issues, this was the answer to the original problem however.
... View more
08-25-2016
08:07 AM
Latest error I'm receiving. I was able to resolve the curl issue, but only after removing passwords.conf and replacing the password in tenable_sc_server.conf and then restarting Splunk a few times. Still doesn't explain why it just stops working randomly. I have verified the credentials are good, and curl returns the right information, but it's still not working:
2016-08-25 15:00:05,516 +0000 log_level=ERROR, pid=3366, tid=Thread-7, file=ta_data_collector.py, func_name=_do_safe_index, code_line_no=161 | [stanza_name="sc_input" data="sc_vulnerability" server="prod_sc"] Failed to get msg
Traceback (most recent call last):
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 151, in _do_safe_index
events, ckpt = self._client.get()
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_client.py", line 73, in get
return self._gen.next()
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/ta_tenable_sc_data_collector.py", line 93, in _process_sc_vulnerability
_pre_process_ckpt(sc, task_config, ckpt, logger_prefix)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/ta_tenable_sc_data_collector.py", line 212, in _pre_process_ckpt
job_start_time, end_time))
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/security_center.py", line 134, in perform_request
self._error_check(response, result)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/security_center.py", line 177, in _error_check
result['error_msg'])
APIError: 'status=403, error_code=12, error_msg=This request contains an invalid token.'
... View more
08-15-2016
01:25 PM
This problem seems to have reared it's ugly head again, and this time it's not the passwords.conf.
After running fine for a few days, it began erroring out, this time with ERROR regarding invalid credentials and invalid tokens in the request. I verified my login credentials directly, which worked, and updated the app, while removing the passwords.conf and allowing it to regenerate, which had no effect.
I ran some curl commands against the passwords API to validate it was getting the right results and began seeing odd behavior. For instance, I ran the following:
curl -q --insecure -u 'admin:password' 'https://localhost:8089//servicesNS/nobody/Splunk_TA_nessus/storage/passwords?count=1'
The result returned for the Splunk_TA_cisco-ise (WHAAAT?) app instead. If I changed the "count" to 0 or -1, I would get the right app to return, but the following text for clear password:
<s:key name="clear_password">proxy_password``splunk_cred_sep````splunk_cred_sep``proxy_username``splunk_cred_sep``</s:key>
Could this be a bug? I'm not sure what could cause this.
... View more
08-10-2016
10:57 AM
3 Karma
Yes, part of the shutdown of the service is to wait for all queues to finish. This is why Splunkd can take longer to restart at times, you can watch this happening in the logs.
... View more
08-08-2016
12:59 PM
1 Karma
So that was part of the issue, it was in fact that the passwords.conf that was generated was messed up during an ES upgrade and merging of TA's. The unfortunate issue is how this gets deployed via the Deployment Server. Being that it generates a passwords.conf after restart, it doesn't jive well with how the Deployment Server works.
Once manually installed on the Heavy Forwarder and the passwords.conf cleared and re-generated, it seems to be working fine.
... View more
08-08-2016
10:39 AM
9 Karma
I have the latest TA Nessus installed and it was working fine for about a week importing nessus reports through the Tenable API calls. It then stopped indexing events and reported the following error(s):
2016-08-08 17:04:27,658 +0000 log_level=ERROR, pid=18084, tid=MainThread, file=ta_mod_input.py, func_name=main, code_line_no=186 | Tenable task encounter exception Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_mod_input.py", line 183, in main config_cls=configer_cls) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_mod_input.py", line 100, in run tconfig = tc.create_ta_config(settings, config_cls or tc.TaConfig) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_config.py", line 181, in create_ta_config return config_cls(meta_config, settings) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_config.py", line 24, in __init__ self._load_task_configs() File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_config.py", line 48, in _load_task_configs self._client_schema) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_helper.py", line 67, in __init__ self._load_conf_contents() File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_helper.py", line 93, in _load_conf_contents self._all_conf_contents = self._config.load() File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/config.py", line 127, in load raise ConfigException(msg) ConfigException: Fail to load endpoint "global_settings" - Unspecified internal server error. reason={"messages":[{"type":"ERROR","text":"\n In handler 'ta_tenable_settings': External handler failed with code '1' and output: 'REST ERROR[1021]: Fail to decrypt the encrypted credential information - not well-formed (invalid token): line 135, column 41'. See splunkd.log for stderr output."}]}
as well as:
2016-08-08 17:04:27,658 +0000 log_level=ERROR, pid=18084, tid=MainThread, file=config.py, func_name=log, code_line_no=50 | UCC Config Module: Fail to load endpoint "global_settings" - Unspecified internal server error. reason={"messages":[{"type":"ERROR","text":"\n In handler 'ta_tenable_settings': External handler failed with code '1' and output: 'REST ERROR[1021]: Fail to decrypt the encrypted credential information - not well-formed (invalid token): line 135, column 41'. See splunkd.log for stderr output."}]}
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/tenable_sc.py", line 21, in <module>
ta_run()
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/tenable_sc.py", line 17, in ta_run
ta_input.main(collector_cls, schema_file_path, 'tenable_sc')
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_mod_input.py", line 183, in main
config_cls=configer_cls)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_mod_input.py", line 100, in run
tconfig = tc.create_ta_config(settings, config_cls or tc.TaConfig)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_config.py", line 181, in create_ta_config
return config_cls(meta_config, settings)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_config.py", line 24, in __init__
self._load_task_configs()
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_config.py", line 48, in _load_task_configs
self._client_schema)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_helper.py", line 67, in __init__
self._load_conf_contents()
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_helper.py", line 93, in _load_conf_contents
self._all_conf_contents = self._config.load()
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/config.py", line 126, in load
log(msg, level=logging.ERROR, need_tb=True)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/config.py", line 48, in log
stack = ''.join(traceback.format_stack())
None
I've tried restarting the Heavy Forwarder that is collecting it, as well as changing the "start_time" located in the tenable_sc_inputs.conf to try and reset the checkpoint information, but no luck.
... View more
04-29-2016
10:41 AM
Read through the release notes, I must have skimmed that line. Thanks for the clarification! RTFM FTW.
... View more
04-20-2016
01:32 PM
Update: I was mistaken about the standalone SH, it seems to be working fine. This seems to be an issue with Search Head Clusters. Any ideas?
... View more
04-20-2016
08:11 AM
I have a new install running Splunk 6.4 on RHEL 7. I have a Search Head Cluster with 3 members and pushed the DB Connect 2 app out via the Search Head Deployer. I have Java 1.8.0_77 installed on all of my Search Heads and configured the correct path within the DB Connect app (/usr/java/jre1.8.0_77). The RPC server status icon shows green, however, I noticed upon page refresh it would switch to "Down" and then with another refresh goes back to "Up".
In the rpc.log I can see the RPC server consistently restarting, as seen here:
I have debug logging enabled but it doesn't show anything of value. SELinux is permissive, and normal system logs do not report anything related. Could this be a bug with 6.4?
I also tested on a non-clustered SH and got the same result.
... View more
03-17-2016
12:22 PM
1 Karma
Hi Dave, long time no talk! (It's Cooper, your PS guy)
I'm on a current engagement with another customer on 6.3.3 and see this issue still. 😞
... View more
03-08-2016
10:48 AM
Did you find a solution to the "certificate verify failed"?
... View more
03-01-2016
01:16 PM
On customer engagement, running 6.3.3 and experiencing the exact same issue. Verified permissions for both the ../etc/master-apps version and ../etc/shcluster/apps version but when they get pushed to cluster, they lose the execute flag.
... View more
12-10-2015
01:08 PM
Any update on this yet? Still doing customer ES engagements and having this problem... 😕
... View more
12-08-2015
11:00 AM
I am seeing this on a customer site now as well, it impacts the Enterprise Security app also as it has no "action" field extraction which originates from a lookup that bases it on the "Type" field, which also does not exist.
Hoping Splunk can speak to this soon as it does impact current customer deployments.
... View more
03-26-2015
06:00 AM
Our environment is a blend of both actually. The original team really had very little understanding of the implications of this. I had them order new physical servers to replace all the VM's at the indexing tier. The other issue is they have three storage technologies at play on the indexers: HBA to FC SAN, VM Datastore and NFS. Needless to say I disabled the indexers using NFS day one...
... View more
03-26-2015
05:55 AM
No obvious resolution on my end. I disabled a lot of the data model acceleration and just kept very specific ones running and just let them go. Eventually, I would catch them at 100% completed. Since then, I've slowly enabled the DM's that I need and it's been performing pretty well. I do have some performance issues at my indexing tier, so I'm hoping that our new server swap happening soon will resolve that.
I am interested to know what Support says on this so please let us know, thanks.
... View more
11-13-2014
07:50 AM
Here is one example, I have the "Intrusion Detection" data model being accelerated for 1 day. It has now been running for well over a week or so, and here are it's current stats:
Status: 99.92% Completed
Access Count: 379 Last Access: 2014-11-13T 10:40:01-05:00
Size on Disk: 63.03MB
Summary Range: 86400
Buckets: 1414
I'd take any guesses as to what it could be. Perhaps bucket rotation is an issue? Seems like a lot of buckets for only 63.03MB of data.
... View more
09-23-2014
08:27 AM
7 Karma
I'm working on tuning our data model accelerations and the first problem I'm running into is that they never finish. I currently have only the Application State data model being accelerated (and enforced) with a 1 day time range and it stays at 99.##% complete. This concerns me because it constantly ties up resources on our indexers. If I enable multiple accelerations it will bring our indexing tier to it's knees.
I have ensured that the volumes have enough space, and I am storing the datamodel_summary along with the hot buckets. All volumes have plenty of space so I'm not sure what the problem can be. I have not made any changes to the default data models.
I appreciate any suggestions.
... View more
09-02-2014
01:00 PM
Still no help on this? I am seeing this same issue, also getting authentication errors/timeouts on search peers periodically. Thought it had to do with too many search jobs, but ruled that out when I disabled everything.
... View more
08-22-2014
08:27 AM
Did you ever find a fix for this? I am currently experiencing the same problem. Had it in version 5.0.7 and still in 6.1.3. I'm thinking it has something to do with it having to query the indexers to find out what indexes are available, but still shouldn't take this long.
... View more
06-06-2014
04:57 AM
I was able to solve this by adding a "... | dedup user | ..." to the inactive_accounts_usage macro.
Unfortunately, when I tried your suggestion, I noticed that even in 2.4 it was still organizing the data by user. For some reason though, there would still be duplicates for some users, allowing them to age beyond the 90-day mark thus causing a false positive notable event.
Thank you for your help though, it did point me in the right direction.
... View more
05-22-2014
10:44 AM
I have a follow up question that I could not find an answer for in the docs. Once a user that is considered inactive is removed from the environment, how is that user removed from the access_tracker in order for it not be alerted on again? Is this a manual process of editing the access_tracker lookup table? I appreciate any help.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
