topic Re: Splunk DB Connect - pad block corrupted in Other Usage

Splunk DB Connect - pad block corrupted

arlombar — Fri, 08 Mar 2019 14:13:17 GMT

I'm trying to install the splunk DB connect app in a new distributed lower environment and am running into the below error any time I enter an input:

"java.lang.RuntimeException: java.security.GeneralSecurityException: org.bouncycastle.crypto.InvalidCipherTextException: pad block corrupted"

For context, we currently have this app setup in our testing environment and I am copying over the same directories/files which include identities, connections, drivers, etc. I did create a input in our testing environment, but that file (db_inputs.conf) is not being recognized in the app on my new environment.

The other articles that I found did not appear to have a solution to problem. If anything has any advise or context to this problem, please advise.

Re: Splunk DB Connect - pad block corrupted

arlombar — Fri, 08 Mar 2019 14:14:36 GMT

Splunk v7.0.4
Splunk DB connect v3.1.4

Re: Splunk DB Connect - pad block corrupted

harsmarvania57 — Tue, 29 Sep 2020 23:40:08 GMT

Hi,

Have you installed Splunk DB connect on new environment and then copied identities.conf, db_connections.conf and db_inputs.conf from test environment to new environment ? If yes then it will not work because identities.conf have encrypted password and those password encryption/decryption is depend on $SPLUNK_HOME/etc/apps/splunk_app_db_connect/certs/identity.dat file and this identity.dat file will generate when you install DB Connect first time. If you want to copy identities.conf,db_connections.confanddb_inputs.conffrom test environment to this new environment then I'll suggest to copy whole app$SPLUNK_HOME/etc/apps/splunk_app_db_connect/` from test environment to new environment if new environment doesn't contain any additional DB Connections, Identities and Inputs compare to test environment.

If you don not want to copy whole app from test environment to new environment then you need to re-enter plain text password for every identities in DB Connect Web GUI and DB connect will store correct encrypted password in identities.conf

Re: Splunk DB Connect - pad block corrupted

arlombar — Mon, 11 Mar 2019 17:07:17 GMT

Thanks for your advise. I tried originally using your method of pulling the entire directory/app from my other environment and adding this directly onto my new boxes, but I am running into another error now:

"Cannot communicate with task server, please check your settings."

My impression is that this is related to the JRE, however this is the same JDK/JRE that I have installed on the working environment...

When moving these app between environments, is it recommended to just install base copies where needed then add in the conf files later or even manually add them as an entry into the UI? This is the only app so far I've ever had an issue like this when moving between environments.

Re: Splunk DB Connect - pad block corrupted

harsmarvania57 — Tue, 12 Mar 2019 09:08:47 GMT

For Task Server error, can you please check below points ?

Check any error in $SPLUNK_HOME/var/log/splunk/splunk_app_fb_connect_*.log
Check JRE path on server, there might be possibility that JRE installed in test environment and new environment has different paths and due to copying entire app from test to new environment it is causing an issue, you can set JRE path in $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/dbx_settings.conf
Check Task Server Port is occupied by any other process/application on new server ?

Re: Splunk DB Connect - pad block corrupted

amartin6 — Wed, 01 Apr 2020 13:43:37 GMT

We built a new search head and added it to an existing cluster with DB Connect, before adding the new server to the load balancers we ran a dbx query and received the same error as reported here. Our fix was to retype the passwords for each identity.

Re: Splunk DB Connect - pad block corrupted

anywhere99 — Thu, 11 Feb 2021 08:48:50 GMT

Thx for the information. Just did this step to reenter the password but I needed to recreate all the identities manually then it worked.

Re: Splunk DB Connect - pad block corrupted

_smp_ — Thu, 13 Jan 2022 13:59:33 GMT

Thanks, fixed me too.