AppD Archive

Analytics Agent Log Warning - Invalid Cookie Header

CommunityUser
Splunk Employee
Splunk Employee

Why am I getting this warning in my analytics-agent.log:

[2017-07-13T12:10:22,040Z]  [WARN ]  [analytics-agent-sync-thread-0]
[o.a.h.c.p.ResponseProcessCookies]  Invalid cookie header: "Set-Cookie:
visid_incap_975740=oWU1GqupSuerw3RWg3AYpS1jZ1kAAAAAQUIPAAAAAACBjxh21OXK36CE0XpBfz8J;
expires=Thu, 12 Jul 2018 12:35:32 GMT; path=/; Domain=.saas.appdynamics.com".
Invalid 'expires' attribute: Thu, 12 Jul 2018 12:35:32 GMT

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Thanks, @Gaurav.Soni and @Mohammed.Rayan.

Circling back, @Anonymous, were you able to figure out what caused those warning?

If yes, please share with the community, so others can find it useful.

Let us know if you have further questions or concerns.

0 Karma

Gaurav_Soni
Contributor

 Hi Andreas,

This is a third party cookie to filter out malicious requests. I don't see a reason why these cookies have invalidly expired attribute except as per what I know it should have an expiry of 2 years. However, I don't think it should cause any issues in analytics agent functioning. Do you see any issue? Let me know.

Can you please let us know which analytics agent version is in use? Also, can you attach the analytics-agent.properties file?

Is this from prod environment?

Regards,

Gaurav Soni

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Well, I'm troubleshooting an issue where the 4.3 analytic-agent won't seem to report any data back to the controller in our dev environment. I'm using the same approach as when I enabled it successfully for the 4.2 analytic-agent and controller. Not sure if the warning is the reason behind, but its the only lead I got at this moment.

Agent Version:

Build information [buildName=1471-4.3.2.next-build, buildHash=, buildTimestamp=2017-06-07T04:05:36+0000, buildNumber=8581, jobName=build-analytics-shared, version=4.3.2.1]

analytics-agent.propert is attached, but I have removed account information.

0 Karma

Gaurav_Soni
Contributor

Hi Andreas,

The warning should not be the problem.

Please set 

ad.controller.url=

in analytics-agent.properties.

Also, attach the analytics-agent.log file.

Regards,

Gaurav Soni

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

ad.controler.url is set I just removed it from the attached file.

I have attached the logfile also, does this say anything useful?

0 Karma

Gaurav_Soni
Contributor

That was a pretty small log 🙂

However, in the latter portion of the log, I do see the events getting published to SAAS analytics.

analytics-agent / http:eventType:publish:bt: (healthy) Rates (Avg per second. Avg of last 5 min) success: [0.036090], user error: [0.000000], timeout: [0.000000], error: [0.000000]

analytics-agent / http:eventType:publish:log: (healthy) Rates (Avg per second. Avg of last 5 min) success: [0.000000], user error: [0.000000], timeout: [0.000000], error: [0.000000]

analytics-agent / http:receive:bt[[/v1/sinks/bt/*, /v2/sinks/bt/*]]: (healthy) Rates (Avg per second. Avg of last 5 min) success: [0.036090], user error: [0.000000], timeout: [0.000000], error: [0.000000]

So unless we see some error in the controller log controller logs. I would expect data to show up in Analytics.

Where is your controller? SaaS or On-Premise?

Regards,

Gaurav Soni

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Our controller is SaaS and I don't have access to the logs.

0 Karma

Gaurav_Soni
Contributor

Hi Andreas,

Please post the saas controller URL or if you want it to be private, I would suggest opening a support case in helpdesk if you have access. 

Regards,

Gaurav Soni

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

I have sent you a private message to continue this thread.

0 Karma

Gaurav_Soni
Contributor

Hi Andreas,

Can you message me the screenshot of your license screen? Capturing the Global account name and Analytics license. 

I need to check the analytics license validity. 

Regards,

Gaurav Soni

0 Karma

Gaurav_Soni
Contributor

Looking at the logs and I will get back to you.

Yes, the error does look like to be the reason. 

0 Karma

Mohammed_Rayan
Contributor

Hi Andreas/Gaurav,

You can very well post the messages using the Private Messages option available

Steps:

Click on the User Profile Name next to the user's icon and then you should be able to see an option called "Send Message", which can be used to share the sensitive data

Regards,

Mohammed Rayan

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...