Getting Data In

Why are we getting an error "SCRAM-SHA-1 authentication failed" on kvstore?

tokio13
Path Finder

Hello,

I'm experiencing some issues on kvstore:

[conn4556] SCRAM-SHA-1 authentication failed for __system on local from client xxx.xxx.x.xx:xxxxx ; AuthenticationFailed: SCRAM-SHA-1 authentication failed, storedKey mismatch

I followed this https://community.splunk.com/t5/Deployment-Architecture/Why-is-the-KV-Store-status-is-showing-as-quo... as for 1SH (total of 3)  I'm reciving:

This member:

backupRestoreStatus : Ready
disabled : 0
guid : xxxxxxxxxxxxxxxxxxxxxx
port : 8191
standalone : 0
status : starting
storageEngine : mmapv1

I appreciate any help

Labels (1)
Tags (2)

NK
Path Finder

I'm seeing the same message logged in mongod.log with Splunk v8.2.10 running on Windows Server.

It is logged as Info ("I ACCESS") instead of Error ("E ACCESS"), so maybe it can be ignored?

Not sure which location "storedKey" it is referring to:

The expired Splunk local certificate was renewed a few months ago (server.pem), but there was still an old copy residing in Windows' certlm.msc repository. Updating the latter doesn't appear to fix the issue.

Environment Variable  SSL_CERT_FILE pointing to server.pem doesn't help either.

0 Karma

trashyroadz
Splunk Employee
Splunk Employee

Are you using a custom certificate, and is it secured with a password? This error suggests an incorrect password, or possibly the password uses special characters and mongod doesn't like them. I found a case where someone using mongod and logging in from the command line had to escape out the special characters in their password. I don't see how that would be an issue with Splunk's implementation o mongod, but might be a good thing to test.

In the meantime, I will continue researching as I am working with another Splunk user encountering the same message.

-- now that's Trashy!
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...