Why are we getting an error "SCRAM-SHA-1 authentication failed" on kvstore?

[tokio13]

Hello,

I'm experiencing some issues on kvstore:

[conn4556] SCRAM-SHA-1 authentication failed for __system on local from client xxx.xxx.x.xx:xxxxx ; AuthenticationFailed: SCRAM-SHA-1 authentication failed, storedKey mismatch

I followed this https://community.splunk.com/t5/Deployment-Architecture/Why-is-the-KV-Store-status-is-showing-as-quo... as for 1SH (total of 3)  I'm reciving:

This member:

backupRestoreStatus : Ready
disabled : 0
guid : xxxxxxxxxxxxxxxxxxxxxx
port : 8191
standalone : 0
status : starting
storageEngine : mmapv1

I appreciate any help

[NK]

I'm seeing the same message logged in mongod.log with Splunk v8.2.10 running on Windows Server.

It is logged as Info ("I ACCESS") instead of Error ("E ACCESS"), so maybe it can be ignored?

Not sure which location "storedKey" it is referring to:

The expired Splunk local certificate was renewed a few months ago (server.pem), but there was still an old copy residing in Windows' certlm.msc repository. Updating the latter doesn't appear to fix the issue.

Environment Variable  SSL_CERT_FILE pointing to server.pem doesn't help either.

[trashyroadz]

Are you using a custom certificate, and is it secured with a password? This error suggests an incorrect password, or possibly the password uses special characters and mongod doesn't like them. I found a case where someone using mongod and logging in from the command line had to escape out the special characters in their password. I don't see how that would be an issue with Splunk's implementation o mongod, but might be a good thing to test.

In the meantime, I will continue researching as I am working with another Splunk user encountering the same message.