Azure Event hub input error in Microsoft Cloud Services add on

[bhsakarchourasi]

Hi All,

we are getting below error while adding app account configuration in Microsoft Cloud Services Add On from web UI.

REST Error [400]: Bad Request -- Account authentication failed. Please check your credentials and try again

So to do this configuration as per documentation we did the same from command line and now it seems to be saved without any error.

But after configuring inputs for event hub it's giving below error message in sourcetype=mscs:azure:eventhub:log

2021-02-16 13:36:51,248 level=ERROR pid=50816 tid=MainThread logger=__main__ pos=utils.py:wrapper:72 | datainput="Test" start_time=1613479010 | message="Data input was interrupted by an unhandled exception." Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs/splunksdc/utils.py", line 70, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/mscs_azure_event_hub.py", line 597, in run credential = self._create_credentials(config, proxy) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/mscs_azure_event_hub.py", line 505, in _create_credentials args = parser.parse(content) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs/splunksdc/config.py", line 125, in parse stanza[field.key] = field.parse(content) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs/splunksdc/config.py", line 156, in parse value = super(IntegerField, self).parse(document) File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/splunk_ta_mscs/splunksdc/config.py", line 139, in parse raise KeyError("%s not exists" % self._key) KeyError: 'account_class_type not exists'

First, thing I doubt about is add on making request to azure cloud for authentication because I tried providing other credentials which are working fine with other add on (O365) are also giving same error.

Second, if app account configuraiton is saved without any error are working or not working (as I can't see error in splunkd logs, it was coming when trying to configure from web UI).

Third, what will be the stanza for 'account_class_type' to put in conf file as it's not mentioned in documentation.

Thanks,

Bhaskar

[bhsakarchourasi]

Hi All,

We saw there is update released for Microsoft Cloud Services add on splunk base which describe near to same issue that we are facing with this add on so we tried upgrading the add on but still didn't worked for us.

Plz help to resolve this issue.

Thanks in advance.

Bhaskar 

[bhsakarchourasi]

Hi All,

This issue is partially resolved by providing root certificate into configuration.

path to the certificate is /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/3rdparties/python3/certifi/cacert.pem

I would say addon error handling is not clear enough to show correct error message so that may need to be  updated in coming versions.

Now we are getting below error in event hub inputs configuration. I will be working on it once it resolve I will post the solution, if anyone has faced this issue earlier, comment will be much appreciated.

2021-02-22 13:42:21,663 level=WARNING pid=37627 tid=Thread-1 logger=uamqp.receiver pos=receiver.py:get_state:270 | LinkDetach("ErrorCodes.UnauthorizedAccess: Unauthorized access. 'Listen' claim(s) are required to perform this operation. Resource: 'sb://xyz-namespace.servicebus.windows.net/diagnosticlogs/consumergroups/$default/partitions/0'. TrackingId:d02679b0b93f4cbda26ac45bce14cdf2_G46, SystemTracker:gateway5, Timestamp:2021-02-22T12:42:2

Thanks in advance

Bhaskar

[andygerberkp]

I'm stuck here - do I have to get some certificate from my Azure portal and append it to this file?  I'm getting this same error stream that ends in "KeyError: 'account_class_type not exists'"

[bhsakarchourasi]

Hi andygerberkp,

It depends if there is certificate base authentication is configured in your case than yes you need to import the certificate otherwise please connect with your azure team configure service principal permissions properly that should resolve the issue.

Thanks,

Bhaskar

[bhsakarchourasi]

Further to this.

Last error has been resolved by providing proper entitlement to service principal.

currently getting below messages in event hub input internal logs.

2021-02-26 08:54:25,605 level=INFO pid=31978 tid=MainThread logger=splunksdc.loop pos=loop.py:is_aborted:38 | datainput="securitycenter" start_time=1614307646 | message="Loop has been aborted."

2021-02-26 08:14:18,418 level=WARNING pid=31978 tid=Thread-1 logger=uamqp.connection pos=connection.py:work:255 | ConnectionClose('ErrorCodes.UnknownError: Connection in an unexpected error state.')

Thanks,

Bhaskar

[saad_siddiqi]

Can you please tell me what entitlements you have given to get this working? 

I am encountering the same errors

 LinkDetach("ErrorCodes.UnauthorizedAccess: Unauthorized access. 'Listen' claim(s) are required to perform this operation

[bhsakarchourasi · Accepted solution]

We followed below link and provided  built in ‘Azure Event Hubs Data Receiver’ role.

https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-porta...

Hope this will help you.

Thanks.

[saad_siddiqi]

Yay! that did the trick!

Thanks a lot for your quick response.