topic Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever? in All Apps and Add-ons

Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

gfreitas — Tue, 05 Apr 2016 14:30:41 GMT

I am installing a fresh Splunk 6.3.3 as heavy forwarder and installing the Splunk Add-on for CheckPoint OPSEC LEA on a Linux RedHat machine.

I just installed the add-on and all requirements listed in the app page, but when I open the app, it shows "Manage Connection" and a loading icon that never stops. If I click on "New Connection" button, it also do not open anything. Follow a screenshot of the loading page:

Has anyone have seen this problem before?

I saw this guy who had the same issue, but his solution did not solve my problem: https://answers.splunk.com/answers/329369/splunk-add-on-for-check-point-opsec-lea-connection.html.

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

tsweet_splunk — Tue, 05 Apr 2016 16:01:40 GMT

Did you add the two libraries listed here:

http://docs.splunk.com/Documentation/OPSEC-LEA/latest/Install/Systemrequirements

GNU C library (glibc.i686 32-bit). Install using yum install glibc.i686
PAM shared libraries (pam.i686 32-bit). Install using yum install pam.i686

Last time i had an issue with that app it was I forgot to add these.

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

gfreitas — Tue, 29 Sep 2020 09:18:43 GMT

Yes, I did install both. Follow the outputs of the commands:

[root@vl088 ~] yum list installed | grep glibc
glibc.i686 2.12-1.166.e16_7.3 @rhel-6-server-rpms
glibc.x86_64 2.12-1.166.e16_7.3 @rhel-6-server-rpms
glib-common.x86_64 2.12-1.166.e16_7.3 @rhel-6-server-rpms

[root@vl088 ~] yum list installed | grep pam
fprintd-pam.x86_64 0.1-22.git04fd09cfa.e16
pam.i686 1.1.1-20.e16_7.1 @rhel-6-server-rpms
pam.x86_64 1.1.1-20.e16_7.1 @rhel-6-server-rpms
pam_passwdqc.x86_64 1.10.5-8.e16 @anaconda-RedHatEnterpriseLinux-2015-7020259.x86_64/6.7

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

afieffe_splunk — Wed, 06 Apr 2016 13:17:55 GMT

Hello,
Which licence are you using on your heavy forwarder ?

Regards

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

sha1020 — Wed, 06 Apr 2016 13:44:53 GMT

Hi,

I had the same problem and found out that, in version 3.1.0, the app expects to be installed on an indexer and therefore looks for a list of search peers via the REST API. My workaround was to change the file remote.py to use localhost if no search peers can be found:

--- Splunk_TA_opseclea_linux22/appserver/controllers/remote.py.orig     2015-11-25 13:43:21.000000000 +0100
+++ Splunk_TA_opseclea_linux22/appserver/controllers/remote.py  2015-11-25 16:04:14.000000000 +0100
@@ -43,11 +43,17 @@
         controllers.BaseController.__init__(self, *args, **kwargs)
         self.peer_cache = PeerCache(cache_age=60)


     def get_all_peers(self, sessionKey):
-        peers = en.getEntities("search/distributed/peers", sessionKey=sessionKey)
+        try:
+            peers = en.getEntities("search/distributed/peers", sessionKey=sessionKey)
+        except:
+            filtered_hosts = [ { "status": "available", "peer": "localhost" } ]
+            return filtered_hosts
+
+
         peerHosts = []
         server_info_path = "/services/server/info"

         for name in peers:
             peer = peers[name]

I hope this helps.

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

gfreitas — Wed, 06 Apr 2016 14:18:36 GMT

I'm using forwarder license

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

gfreitas — Wed, 06 Apr 2016 14:19:06 GMT

Hi sha1020, I'm going to try this. Thanks!

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

gfreitas — Wed, 06 Apr 2016 18:06:42 GMT

It worked, thanks!

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

neelamsantosh — Wed, 13 Apr 2016 09:29:11 GMT

Still same, Any other workarounds..

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

hjauch_splunk — Fri, 15 Apr 2016 23:53:42 GMT

Do you by chance have FIPSs mode enabled? There is a known issue with FIPs mode.

OPSEC-398 When FIPs is enabled in a distributed Spunk Enterprise environment, the Manage Connections page cannot be accessed on the search head, even after restarting the Splunk platform.

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

ddearmond_splun — Thu, 05 May 2016 02:36:49 GMT

Did you check to see if data was being indexed after the workaround? When I applied the workaround the GUI didn't change but data started flowing again.

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

wmotley — Thu, 26 May 2016 14:29:43 GMT

Data is being indexed, but no update to the GUI for the connections.

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

rusty009 — Fri, 10 Jun 2016 17:04:29 GMT

Just for future reference - I had the same issue, none of the above solutions seemed to work but when troubleshooting, I found it was an issue with DNS on my server rather than a splunk related issue. After I fixed my DNS resolution everything worked perfectly.

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

kmanson — Tue, 14 Jun 2016 12:27:56 GMT

Thanks it worked for me too, Splunk should really update the app to fix this issue, if they want users to move to latest versions their supported apps should be compatible.

Re: Checkpoint Add-on for Check Point OPSEC LEA: Why is the "Manage Connections" page loading forever?

sha1020 — Wed, 15 Jun 2016 13:37:28 GMT

FIPS mode ist not enabled.

The app is also not installed on a search head, but on a forwarder.