Other Usage

Splunk DB Connect - pad block corrupted

arlombar
Explorer

I'm trying to install the splunk DB connect app in a new distributed lower environment and am running into the below error any time I enter an input:

"java.lang.RuntimeException: java.security.GeneralSecurityException: org.bouncycastle.crypto.InvalidCipherTextException: pad block corrupted"

For context, we currently have this app setup in our testing environment and I am copying over the same directories/files which include identities, connections, drivers, etc. I did create a input in our testing environment, but that file (db_inputs.conf) is not being recognized in the app on my new environment.

The other articles that I found did not appear to have a solution to problem. If anything has any advise or context to this problem, please advise.

Tags (1)
0 Karma

amartin6
Path Finder

We built a new search head and added it to an existing cluster with DB Connect, before adding the new server to the load balancers we ran a dbx query and received the same error as reported here. Our fix was to retype the passwords for each identity.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Have you installed Splunk DB connect on new environment and then copied identities.conf, db_connections.conf and db_inputs.conf from test environment to new environment ? If yes then it will not work because identities.conf have encrypted password and those password encryption/decryption is depend on $SPLUNK_HOME/etc/apps/splunk_app_db_connect/certs/identity.dat file and this identity.dat file will generate when you install DB Connect first time. If you want to copy identities.conf,db_connections.confanddb_inputs.conffrom test environment to this new environment then I'll suggest to copy whole app$SPLUNK_HOME/etc/apps/splunk_app_db_connect/` from test environment to new environment if new environment doesn't contain any additional DB Connections, Identities and Inputs compare to test environment.

If you don not want to copy whole app from test environment to new environment then you need to re-enter plain text password for every identities in DB Connect Web GUI and DB connect will store correct encrypted password in identities.conf

_smp_
Builder
Thanks, fixed me too.
0 Karma

anywhere99
Explorer

Thx for the information. Just did this step to reenter the password but I needed to recreate all the identities manually then it worked.

0 Karma

arlombar
Explorer

Thanks for your advise. I tried originally using your method of pulling the entire directory/app from my other environment and adding this directly onto my new boxes, but I am running into another error now:

"Cannot communicate with task server, please check your settings."

My impression is that this is related to the JRE, however this is the same JDK/JRE that I have installed on the working environment...

When moving these app between environments, is it recommended to just install base copies where needed then add in the conf files later or even manually add them as an entry into the UI? This is the only app so far I've ever had an issue like this when moving between environments.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

For Task Server error, can you please check below points ?

  1. Check any error in $SPLUNK_HOME/var/log/splunk/splunk_app_fb_connect_*.log
  2. Check JRE path on server, there might be possibility that JRE installed in test environment and new environment has different paths and due to copying entire app from test to new environment it is causing an issue, you can set JRE path in $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/dbx_settings.conf
  3. Check Task Server Port is occupied by any other process/application on new server ?

arlombar
Explorer

Splunk v7.0.4
Splunk DB connect v3.1.4

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...