topic Re: Mimecast TA Audit input script issue in All Apps and Add-ons

Mimecast Add-on: Getting error and audit log is not being received.

Ayan — Tue, 25 Aug 2020 15:38:55 GMT

I am seeing this error message from Mimecast TA,

ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mimecast-for-splunk/bin/mimecast_audit.py" ERRORHTTPSConnectionPool(host='us-api.mimecast.com', port=443): Max retries exceeded with url: /api/audit/get-audit-events (Caused by ReadTimeoutError("HTTPSConnectionPool(host='us-api.mimecast.com', port=443): Read timed out. (read timeout=30.0)",))

Did the Mimecast API change or it is something else causing this issue? Mimecast audit log is not getting received due to this issue.

Re: Mimecast TA Audit input script issue

thambisetty — Tue, 18 Aug 2020 18:31:49 GMT

It looks like, your connection is getting blocked by proxy.

check in your proxy logs if you are behind any proxy.

or you could check on your own laptop where everything is opened to see you are able to connect.

Re: Mimecast TA Audit input script issue

Ayan — Wed, 19 Aug 2020 02:41:38 GMT

@thambisetty We do not have any proxy. There other inputs of this TA that are ingesting fine. Except this audit logs .

Re: Mimecast TA Audit input script issue

thambisetty — Wed, 19 Aug 2020 02:44:02 GMT

Its looking like connection error only Based on the error you have posted.

can you Check in internal what is the domain used for other logs ? Is that same us-api.mimiecast.com

Re: Mimecast TA Audit input script issue

Ayan — Wed, 19 Aug 2020 12:23:09 GMT

That's correct, the domain is us-api.mimecast.com. That's base url to use for U.S

Re: Mimecast TA Audit input script issue

Ayan — Tue, 25 Aug 2020 13:42:13 GMT

@thambisetty Do you have any suggestions on this?

Re: Mimecast TA Audit input script issue

thambisetty — Tue, 25 Aug 2020 18:56:22 GMT

I have changed a lot this TA 1.5 years ago to make it work.

I really need to look into it to understand where the problem is.

please message me, I can look it into for you.