Dashboards & Visualizations

splunkd.log: Denied session token for user: splunk-system-user

Stefan
Explorer

My indexers started throwing this:

07-02-2011 04:00:58.307 -0300 WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user

07-02-2011 04:01:05.551 -0300 WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user

As a result, I get an error on the Search Heads stating that it has "skipped indexing of internal audit event will keep dropping events..."

The last time I got this warning at the Search Heads it was due to the optimization taking too long, but this one is new to me, any ideas?

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

Invalid authentication between the search peers and the search head distributing search to these peers would result in an 'Authenication Failed' type of message. This error indicates something is wrong with the token. That the search peer is sending back something in its header requesting access via an invalid token. It could also be related to time I suppose. Have you looked at splunkd_access.log to see if there are any errors in that file?

View solution in original post

yoho
Contributor

It may be due to an edition of distsearch.conf without establishing trusts (indexers must trust searchhead's certificates) so you can fix this problem by following what's written in this paragraph.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

Invalid authentication between the search peers and the search head distributing search to these peers would result in an 'Authenication Failed' type of message. This error indicates something is wrong with the token. That the search peer is sending back something in its header requesting access via an invalid token. It could also be related to time I suppose. Have you looked at splunkd_access.log to see if there are any errors in that file?

anttih
New Member

have you changed your admin passwords recently and is the search head using the correct admin user of the indexer ?
I believe this refers to invalid authentication between search peer and indexer and can be setup in the search peers part of the management console.

0 Karma

Jason
Motivator

Incorrect. The search head only uses the admin password of the indexer once - to send over a certificate. The certificate is used in Distributed Search from there on, so it does not matter if any password is changed on the indexer.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...