topic SymmKey issue in Knowledge Management

SymmKey issue

splukiee — Fri, 12 Jul 2024 09:34:13 GMT

i am getting this error below regarding pass4SymmKey

WARN HTTPAuthManager [1045 MainThread] - pass4SymmKey length is too short. See pass4SymmKey_minLength under the clustering stanza in server.conf
INFO ServerRoles [1045 MainThread] - Declared role=cluster_master.
INFO ServerRoles [1045 MainThread] - Declared role=cluster_manager.
ERROR ClusteringMgr [1045 MainThread] - pass4SymmKey setting in the clustering or general stanza of server.conf is set to empty or the default value. You must change it to a different value.
ERROR loader [1045 MainThread] - clustering initialization failed; won't start splunkd

what exactly the problem is ? i am defined the exact proper legth of pass4SymmKey , but still it is not working . below is the server.conf file ,

The server.conf file for updated version will look like below :
[general]
serverName = ***
pass4SymmKey = generated_pass4SymmKey_value

[sslConfig]
sslPassword = ***

description = ABCDEFGH
peers = *
quota = MAX
stack_id = ***

description = ABCDEFGH
peers = *
quota = MAX
stack_id = forwarder

[***:ABCDEFGH]
description = ABCDEFGH
peers = *
quota = MAX
stack_id = free

[indexer_discovery]

[clustering]
cluster_label = ***
mode = manager
replication_factor = 3
search_factor = 2
pass4SymmKey_minLength = 32

what am i missing ?

Re: pass4SymmKey issue

marnall — Thu, 11 Jul 2024 19:35:51 GMT

It sounds like your bigger problem is that Splunk thinks your pass4SymmKey is empty or set to the default value.

Could you try moving the pass4SymmKey to the [clustering] stanza next to the pass4SymmKey_minLength field?

Re: pass4SymmKey issue

PickleRick — Thu, 11 Jul 2024 20:53:38 GMT

Check your config with btool. It's relatively easy to mistype pass4SymmKey (the name of the option) making it effectively not set.

Re: pass4SymmKey issue

splukiee — Fri, 12 Jul 2024 08:50:20 GMT

@marnall thanks . Did that , also made sure that the of pass4SymmKey & pass4SymmKey_minLength are unique across all locations , but stil the same issue

Re: pass4SymmKey issue

SanjayReddy — Fri, 12 Jul 2024 09:12:08 GMT

Hi @splukiee

have you changed the pass4SymmKey value under general stanza

seems you updated pass4SymmKey for clustring stanza, IMO , log message trggerting for pass4SymmKey under general

also as suggested by @PickleRick can you please run btool for pass4SymmKey to check different location of pass4SymmKey present on the server.

/opt/splunk/bin/splunk btool server list --debug | grep -i pass4SymmKey

Re: pass4SymmKey issue

splukiee — Fri, 12 Jul 2024 09:23:56 GMT

yes both general and clustering stanza updated with pass4key and min length as well . but still the same issue .

Re: SymmKey issue

splukiee — Fri, 12 Jul 2024 09:26:14 GMT

Re: pass4SymmKey issue

splukiee — Fri, 12 Jul 2024 12:13:55 GMT

this is the below output i got using the command :

/opt/splunk/etc/system/default/server.conf pass4SymmKey_minLength = 12
/opt/splunk/etc/system/default/server.conf pass4SymmKey =
/opt/splunk/etc/system/default/server.conf pass4SymmKey_minLength = 12
/opt/splunk/etc/system/default/server.conf encrypt_fields = "****"
/opt/splunk/etc/system/default/server.conf pass4SymmKey = changeme
/opt/splunk/etc/system/default/server.conf pass4SymmKey_minLength = 12
/opt/splunk/etc/system/default/server.conf pass4SymmKey_minLength = 12

Re: pass4SymmKey issue

askargbo — Tue, 01 Oct 2024 13:38:24 GMT

I am having the same issue as yours. Did you ever get to solve this problem? If so, what was the solution? @splukiee

Re: pass4SymmKey issue

askargbo — Tue, 01 Oct 2024 13:58:13 GMT

I just solved the problem by having both pass4SymmKey and pass4SymmKey_Length under the clustering stanza like below:

[clustering]

pass4SymmKey = some keys

pass4SymmKey_Length = 24

You can make your key length to be at least 12. I made mine to be 24 and my keys to be longer.