All Apps and Add-ons

Why is the Splunk Add-on for Atlassian JIRA Alerts failing to connect to a secure JIRA instance?

davidmills
Explorer

The log is showing:

>     message=action=jira STDERR -  Error sending message:
> HTTPSConnectionPool(host='jira.aws.medibank.local',
> port=443): Max retries exceeded with
> url: //rest/api/2/issue (Caused by
> : '')

How can I reconfigure? Do I need to manually configure the self signed certificate?

0 Karma
1 Solution

iamarkaprabha
Contributor

Hi ,

It looks like a SSL certificate issue , add verify=False to the requests.post call on line 34 of jira.py

Let me know the outcome

View solution in original post

iamarkaprabha
Contributor

Hi ,

It looks like a SSL certificate issue , add verify=False to the requests.post call on line 34 of jira.py

Let me know the outcome

davidmills
Explorer

Some improvement. I Added your suggestion and dropped the proxy argument and the health check is now working. But tickets are failing to be created. The change I made in jira.py was from :

result = requests.post(proxies=proxy, url=jira_url, data=body,
headers=headers, auth=(username, password))

to

result = requests.post(url=jira_url, data=body, headers=headers,
auth=(username, password), verify=False)

Now looking into why tickets are failing to be created. It looks like the password has been lost in the reconfigurations. But still the "Setup" link for the Jira Alert action is missing - it comes and goes. So how can I correct the password?

We can manually build a curl that closely matches what jira.py should be using - and it responds as expected. But splunkd.log is showing:

10-14-2018 23:00:04.159 +0000 INFO
sendmodalert - action=jira STDERR -
Jira server HTTP status= 401
10-14-2018 23:00:04.159 +0000 INFO
sendmodalert - action=jira STDERR -
Jira server response: 10-14-2018
23:00:04.160 +0000 ERROR sendmodalert
- action=jira STDERR - 10-14-2018 23:00:04.160 +0000 ERROR
sendmodalert - action=jira STDERR -
10-14-2018 23:00:04.160 +0000
ERROR sendmodalert - action=jira
STDERR - 10-14-2018 23:00:04.160
+0000 ERROR sendmodalert - action=jira STDERR - 10-14-2018 23:00:04.160 +0000
ERROR sendmodalert - action=jira
STDERR -

10-14-2018 23:00:04.160 +0000 ERROR
sendmodalert - action=jira STDERR -
10-14-2018 23:00:04.160 +0000 ERROR
sendmodalert - action=jira STDERR -

0 Karma

davidmills
Explorer

I've added a few comments to the ticket/question - but perhaps you haven't see.

The addition of verify=False fixed the issue first posted - thanks for that. - I also needed to drop "proxies=proxy" from the request.post entry.

However, now any use of the Jira app is met with authentication error. I believe that when I add the credentials to the Setup page via the Splunk UI, that it is saving the URL and username, but not the password. I have touched a file in /tmp just prior to setting the credentials (on both the Index master and the search head cluster instances), then added the credentials, then searched for changed files. I found that ./etc/apps/splunk-add-on-jira-alerts/local/alert_actions.conf was getting all the values added except the password. It is possible that the password is getting added to the KVStore - but I'm not sure how to confirm this.

Any suggestions?

The error logged in splunkd.log is:

10-14-2018 23:00:04.159 +0000 INFO
sendmodalert - action=jira STDERR -
Jira server HTTP status= 401
10-14-2018 23:00:04.159 +0000 INFO
sendmodalert - action=jira STDERR -
Jira server response: 10-14-2018
23:00:04.160 +0000 ERROR sendmodalert
- action=jira STDERR - 10-14-2018 23:00:04.160 +0000 ERROR
sendmodalert - action=jira STDERR -
10-14-2018 23:00:04.160 +0000
ERROR sendmodalert - action=jira
STDERR - 10-14-2018 23:00:04.160
+0000 ERROR sendmodalert - action=jira STDERR - 10-14-2018 23:00:04.160 +0000
ERROR sendmodalert - action=jira
STDERR -

10-14-2018 23:00:04.160 +0000 ERROR
sendmodalert - action=jira STDERR -
10-14-2018 23:00:04.160 +0000 ERROR
sendmodalert - action=jira STDERR -

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...