Getting Data In

Why are we getting an error "SCRAM-SHA-1 authentication failed" on kvstore?

tokio13
Path Finder

Hello,

I'm experiencing some issues on kvstore:

[conn4556] SCRAM-SHA-1 authentication failed for __system on local from client xxx.xxx.x.xx:xxxxx ; AuthenticationFailed: SCRAM-SHA-1 authentication failed, storedKey mismatch

I followed this https://community.splunk.com/t5/Deployment-Architecture/Why-is-the-KV-Store-status-is-showing-as-quo... as for 1SH (total of 3)  I'm reciving:

This member:

backupRestoreStatus : Ready
disabled : 0
guid : xxxxxxxxxxxxxxxxxxxxxx
port : 8191
standalone : 0
status : starting
storageEngine : mmapv1

I appreciate any help

Labels (1)
Tags (2)

NK
Explorer

I'm seeing the same message logged in mongod.log with Splunk v8.2.10 running on Windows Server.

It is logged as Info ("I ACCESS") instead of Error ("E ACCESS"), so maybe it can be ignored?

Not sure which location "storedKey" it is referring to:

The expired Splunk local certificate was renewed a few months ago (server.pem), but there was still an old copy residing in Windows' certlm.msc repository. Updating the latter doesn't appear to fix the issue.

Environment Variable  SSL_CERT_FILE pointing to server.pem doesn't help either.

0 Karma

trashyroadz
Splunk Employee
Splunk Employee

Are you using a custom certificate, and is it secured with a password? This error suggests an incorrect password, or possibly the password uses special characters and mongod doesn't like them. I found a case where someone using mongod and logging in from the command line had to escape out the special characters in their password. I don't see how that would be an issue with Splunk's implementation o mongod, but might be a good thing to test.

In the meantime, I will continue researching as I am working with another Splunk user encountering the same message.

-- now that's Trashy!
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...