AppD Archive

Analytics Agent Log Warning - Invalid Cookie Header

CommunityUser
Splunk Employee
Splunk Employee

Why am I getting this warning in my analytics-agent.log:

[2017-07-13T12:10:22,040Z]  [WARN ]  [analytics-agent-sync-thread-0]
[o.a.h.c.p.ResponseProcessCookies]  Invalid cookie header: "Set-Cookie:
visid_incap_975740=oWU1GqupSuerw3RWg3AYpS1jZ1kAAAAAQUIPAAAAAACBjxh21OXK36CE0XpBfz8J;
expires=Thu, 12 Jul 2018 12:35:32 GMT; path=/; Domain=.saas.appdynamics.com".
Invalid 'expires' attribute: Thu, 12 Jul 2018 12:35:32 GMT

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Thanks, @Gaurav.Soni and @Mohammed.Rayan.

Circling back, @Anonymous, were you able to figure out what caused those warning?

If yes, please share with the community, so others can find it useful.

Let us know if you have further questions or concerns.

0 Karma

Gaurav_Soni
Contributor

 Hi Andreas,

This is a third party cookie to filter out malicious requests. I don't see a reason why these cookies have invalidly expired attribute except as per what I know it should have an expiry of 2 years. However, I don't think it should cause any issues in analytics agent functioning. Do you see any issue? Let me know.

Can you please let us know which analytics agent version is in use? Also, can you attach the analytics-agent.properties file?

Is this from prod environment?

Regards,

Gaurav Soni

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Well, I'm troubleshooting an issue where the 4.3 analytic-agent won't seem to report any data back to the controller in our dev environment. I'm using the same approach as when I enabled it successfully for the 4.2 analytic-agent and controller. Not sure if the warning is the reason behind, but its the only lead I got at this moment.

Agent Version:

Build information [buildName=1471-4.3.2.next-build, buildHash=, buildTimestamp=2017-06-07T04:05:36+0000, buildNumber=8581, jobName=build-analytics-shared, version=4.3.2.1]

analytics-agent.propert is attached, but I have removed account information.

0 Karma

Gaurav_Soni
Contributor

Hi Andreas,

The warning should not be the problem.

Please set 

ad.controller.url=

in analytics-agent.properties.

Also, attach the analytics-agent.log file.

Regards,

Gaurav Soni

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

ad.controler.url is set I just removed it from the attached file.

I have attached the logfile also, does this say anything useful?

0 Karma

Gaurav_Soni
Contributor

That was a pretty small log 🙂

However, in the latter portion of the log, I do see the events getting published to SAAS analytics.

analytics-agent / http:eventType:publish:bt: (healthy) Rates (Avg per second. Avg of last 5 min) success: [0.036090], user error: [0.000000], timeout: [0.000000], error: [0.000000]

analytics-agent / http:eventType:publish:log: (healthy) Rates (Avg per second. Avg of last 5 min) success: [0.000000], user error: [0.000000], timeout: [0.000000], error: [0.000000]

analytics-agent / http:receive:bt[[/v1/sinks/bt/*, /v2/sinks/bt/*]]: (healthy) Rates (Avg per second. Avg of last 5 min) success: [0.036090], user error: [0.000000], timeout: [0.000000], error: [0.000000]

So unless we see some error in the controller log controller logs. I would expect data to show up in Analytics.

Where is your controller? SaaS or On-Premise?

Regards,

Gaurav Soni

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Our controller is SaaS and I don't have access to the logs.

0 Karma

Gaurav_Soni
Contributor

Hi Andreas,

Please post the saas controller URL or if you want it to be private, I would suggest opening a support case in helpdesk if you have access. 

Regards,

Gaurav Soni

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

I have sent you a private message to continue this thread.

0 Karma

Gaurav_Soni
Contributor

Hi Andreas,

Can you message me the screenshot of your license screen? Capturing the Global account name and Analytics license. 

I need to check the analytics license validity. 

Regards,

Gaurav Soni

0 Karma

Gaurav_Soni
Contributor

Looking at the logs and I will get back to you.

Yes, the error does look like to be the reason. 

0 Karma

Mohammed_Rayan
Contributor

Hi Andreas/Gaurav,

You can very well post the messages using the Private Messages option available

Steps:

Click on the User Profile Name next to the user's icon and then you should be able to see an option called "Send Message", which can be used to share the sensitive data

Regards,

Mohammed Rayan

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...