AMQP Messaging Modular Input: What is causing error "It has been determined via the REST API that all inputs have been disabled."?

[teddystrand]

Hi Damien,

Every time I enable your amqp app it retrieves approximately 800 messages from my RabbitMQ queue, but then it stops because of the following (from splunkd.log):

02-09-2015 17:13:07.305 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/amqp_ta/bin/amqp.py" Can't connect to Splunk REST API with the token [Splunk RhMYOWU5UveKs_nVWfsMYQM52waB5i7v6^jauWlhXf3FDmRz4xZYz_u^CBLzU1ED6ruqL^8aft8cZ3NG6Y_unl1bLHbCUGhqs2IV8Ds8gGp_enr2BaZNPy0], either the token is invalid or SplunkD has exited : null
02-09-2015 17:13:17.306 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/amqp_ta/bin/amqp.py" It has been determined via the REST API that all inputs have been disabled

So I have to enable/disable your app to import all my (30.000+) messages.

Do you have any idea of what might be causing this? I tried messing around with sslv3 vs tls etc. (as per looking at other answers on this page), but it remains the same.

Thank you in advance,
Teddy Strand

[Damien_Dallimor · Accepted solution]

I rolled back the newest release , found a bug.

[teddystrand]

Hi Damien,

After I just downgraded it seems to work. So I guess that this bug of yours caused the REST api to mess up?
Thank you very much for your incredible fast responses!

Teddy

[Damien_Dallimor]

Latest Java SDK that I hacked to do TLS had some weirdness that was causing incompatibilitys with my underlying Java Mod Input framework.

[Damien_Dallimor]

Update : try the version here : http://damiendallimore.github.io/ (before I release it and screw up Splunkbase again 🙂 )

I weeded out the TLS bug / SDK incompatibilitys issues

[Damien_Dallimor]

Do you have any idea of what might be causing this?

Can you as throughly as possibly describe your environment , I'm flying blind here.

Versions of everything helps (Splunk , Java runtime, AMQP version)
Your AMQP configuration you setup in Splunk

I tried messing around with sslv3 vs tls etc.

Any more technical specifics here of what you did ?

Also , check that "localhost" DNS resolves correctly on your host for the interface that Splunk is bound to.

[fabiocaldas]

I'm having this same problem with Amazon Kinesis Modular Input

[teddystrand]

Hi,

Splunk 6.2 (newest) running.
java version "1.7.0_75"
OpenJDK Runtime Environment (rhel-2.5.4.0.el6_6-x86_64 u75-b13)
OpenJDK 64-Bit Server VM (build 24.75-b04, mixed mode)
I cannot access RabbitMQ from VPN, so I am unsure of what version of amqp my version uses.

Localhost resolves fine.
Your app does indeed swallow messages just fine and fast, but it receives this "stop signal" as described above. I have no idea what this REST api for Splunk is used for in regards to your app.
This happens on CentOS and also Windows 7 - same errors in the log file.

In regards to sslv3/tls:
I commented the relevant line in java.security to allow/enable sslv3 in java. That didn't work. I also tried to provide the additional java parameters in your app settings (as provided in your changelog) without any luck.

Thank you