All Apps and Add-ons

Azure Event hub input error in Microsoft Cloud Services add on

bhsakarchourasi
Path Finder

Hi All,

we are getting below error while adding app account configuration in Microsoft Cloud Services Add On from web UI.

REST Error [400]: Bad Request -- Account authentication failed. Please check your credentials and try again

So to do this configuration as per documentation we did the same from command line and now it seems to be saved without any error.

But after configuring inputs for event hub it's giving below error message in sourcetype=mscs:azure:eventhub:log

2021-02-16 13:36:51,248 level=ERROR pid=50816 tid=MainThread logger=__main__ pos=utils.py:wrapper:72 | datainput="Test" start_time=1613479010 | message="Data input was interrupted by an unhandled exception." Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs/splunksdc/utils.py", line 70, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/mscs_azure_event_hub.py", line 597, in run credential = self._create_credentials(config, proxy) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/mscs_azure_event_hub.py", line 505, in _create_credentials args = parser.parse(content) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs/splunksdc/config.py", line 125, in parse stanza[field.key] = field.parse(content) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs/splunksdc/config.py", line 156, in parse value = super(IntegerField, self).parse(document) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs/splunksdc/config.py", line 139, in parse raise KeyError("%s not exists" % self._key) KeyError: 'account_class_type not exists'

 

First, thing I doubt about is add on making request to azure cloud for authentication because I tried providing other credentials which are working fine with other add on (O365) are also giving same error.

Second, if app account configuraiton is saved without any error are working or not working (as I can't see error in splunkd logs, it was coming when trying to configure from web UI).

Third, what will be the stanza for 'account_class_type' to put in conf file as it's not mentioned in documentation.

 

Thanks,

Bhaskar

Labels (3)
0 Karma
1 Solution

bhsakarchourasi
Path Finder

We followed below link and provided  built in ‘Azure Event Hubs Data Receiver’ role.

 
Hope this will help you.
 
Thanks.

View solution in original post

Tags (1)

bhsakarchourasi
Path Finder

Hi All,

We saw there is update released for Microsoft Cloud Services add on splunk base which describe near to same issue that we are facing with this add on so we tried upgrading the add on but still didn't worked for us.

Plz help to resolve this issue.

Thanks in advance.

Bhaskar 

Tags (2)
0 Karma

bhsakarchourasi
Path Finder

Hi All,

This issue is partially resolved by providing root certificate into configuration.

path to the certificate is /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/3rdparties/python3/certifi/cacert.pem

I would say addon error handling is not clear enough to show correct error message so that may need to be  updated in coming versions.

Now we are getting below error in event hub inputs configuration. I will be working on it once it resolve I will post the solution, if anyone has faced this issue earlier, comment will be much appreciated.

2021-02-22 13:42:21,663 level=WARNING pid=37627 tid=Thread-1 logger=uamqp.receiver pos=receiver.py:get_state:270 | LinkDetach("ErrorCodes.UnauthorizedAccess: Unauthorized access. 'Listen' claim(s) are required to perform this operation. Resource: 'sb://xyz-namespace.servicebus.windows.net/diagnosticlogs/consumergroups/$default/partitions/0'. TrackingId:d02679b0b93f4cbda26ac45bce14cdf2_G46, SystemTracker:gateway5, Timestamp:2021-02-22T12:42:2

 

Thanks in advance

Bhaskar

Tags (1)
0 Karma

andygerberkp
Explorer

I'm stuck here - do I have to get some certificate from my Azure portal and append it to this file?  I'm getting this same error stream that ends in "KeyError: 'account_class_type not exists'"

0 Karma

bhsakarchourasi
Path Finder

Hi andygerberkp,

It depends if there is certificate base authentication is configured in your case than yes you need to import the certificate otherwise please connect with your azure team configure service principal permissions properly that should resolve the issue.

 

Thanks,

Bhaskar

 

 

0 Karma

bhsakarchourasi
Path Finder

Further to this.

Last error has been resolved by providing proper entitlement to service principal.

currently getting below messages in event hub input internal logs.

2021-02-26 08:54:25,605 level=INFO pid=31978 tid=MainThread logger=splunksdc.loop pos=loop.py:is_aborted:38 | datainput="securitycenter" start_time=1614307646 | message="Loop has been aborted."
2021-02-26 08:14:18,418 level=WARNING pid=31978 tid=Thread-1 logger=uamqp.connection pos=connection.py:work:255 | ConnectionClose('ErrorCodes.UnknownError: Connection in an unexpected error state.')
 
Thanks,
Bhaskar
Tags (1)
0 Karma

saad_siddiqi
Path Finder

Can you please tell me what entitlements you have given to get this working? 

I am encountering the same errors

 LinkDetach("ErrorCodes.UnauthorizedAccess: Unauthorized access. 'Listen' claim(s) are required to perform this operation

0 Karma

bhsakarchourasi
Path Finder

We followed below link and provided  built in ‘Azure Event Hubs Data Receiver’ role.

 
Hope this will help you.
 
Thanks.
Tags (1)

saad_siddiqi
Path Finder

Yay! that did the trick!

Thanks a lot for your quick response.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...