All Apps and Add-ons

Splunk Add-on for Microsoft Cloud Services showing proxy issue

rbal_splunk
Splunk Employee
Splunk Employee

We are experiencing a proxy issue with the Splunk Add-on for Microsoft Cloud Service. The add-on supports proxy for Azure Audit and Resource data inputs, however, it does not work when enabling this functionality.

We have also tried configuring the proxy on the local system by adding the environment variable below to the splunk/etc/splunk-launch.conf file to no avail.

http_proxy=<proxy_host>:<port_number>
https_proxy=<proxy_host>:<port_number>

Analyzing the network traffic using tcpdump reveal that the add-on does not even try to connect using the proxy. There is not a single SYN tcp flag to the proxy.

0 Karma
1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

Found out that this issue is expected to be fixed in Splunk Add-on for Microsoft Cloud Services version 3.0.0
Here is workaround that worked

Open file %SPLUNK_HOME%/etc/appsSplunk_TA_microsoft-cloudservices/bin/splunktamscs/mscs_azure_base_data_collector.py with a text editor. Locate the following lines (the two digests in front indicate line number in 2.1.x release, it may differ if the user us running another version:

59 def _get_proxies(proxy_config):
60    proxy_as_tuple = proxy_from_config(proxy_config)
61    if not proxy_as_tuple:
62        return None
63    host, port, user, password = proxy_as_tuple
64    if user and password:
65        proxy_string = '{user}:{password}@{host}:{port}'.format(
66            user=user, password=password, host=host, port=port
67        )
68    else:
69        proxy_string = '{host}:{port}'.format(host=host, port=port)
70    return {
71        'http': 'http://{}'.format(proxy_string),
72        'https': 'https://{}'.format(proxy_string)
73    }

then change (line 72)

'https': 'https://{}'.format(proxy_string)
to (replace the second 'https' to 'http')
'https': 'http://{}'.format(proxy_string)

Finally, change (line 113)

self._credentials = ProxyableServicePrincipalCredentials(
 to
self._credentials = ServicePrincipalCredentials( 

Hope this helps.

View solution in original post

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Found out that this issue is expected to be fixed in Splunk Add-on for Microsoft Cloud Services version 3.0.0
Here is workaround that worked

Open file %SPLUNK_HOME%/etc/appsSplunk_TA_microsoft-cloudservices/bin/splunktamscs/mscs_azure_base_data_collector.py with a text editor. Locate the following lines (the two digests in front indicate line number in 2.1.x release, it may differ if the user us running another version:

59 def _get_proxies(proxy_config):
60    proxy_as_tuple = proxy_from_config(proxy_config)
61    if not proxy_as_tuple:
62        return None
63    host, port, user, password = proxy_as_tuple
64    if user and password:
65        proxy_string = '{user}:{password}@{host}:{port}'.format(
66            user=user, password=password, host=host, port=port
67        )
68    else:
69        proxy_string = '{host}:{port}'.format(host=host, port=port)
70    return {
71        'http': 'http://{}'.format(proxy_string),
72        'https': 'https://{}'.format(proxy_string)
73    }

then change (line 72)

'https': 'https://{}'.format(proxy_string)
to (replace the second 'https' to 'http')
'https': 'http://{}'.format(proxy_string)

Finally, change (line 113)

self._credentials = ProxyableServicePrincipalCredentials(
 to
self._credentials = ServicePrincipalCredentials( 

Hope this helps.

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!