SymmKey issue

[splukiee]

i am getting this error below regarding pass4SymmKey

WARN HTTPAuthManager [1045 MainThread] - pass4SymmKey length is too short. See pass4SymmKey_minLength under the clustering stanza in server.conf
INFO ServerRoles [1045 MainThread] - Declared role=cluster_master.
INFO ServerRoles [1045 MainThread] - Declared role=cluster_manager.
ERROR ClusteringMgr [1045 MainThread] - pass4SymmKey setting in the clustering or general stanza of server.conf is set to empty or the default value. You must change it to a different value.
ERROR loader [1045 MainThread] - clustering initialization failed; won't start splunkd

what exactly the problem is ? i am defined the exact proper legth of pass4SymmKey , but still it is not working . below is the server.conf file , 

The server.conf file for updated version will look like below :
[general]
serverName = ***
pass4SymmKey = generated_pass4SymmKey_value

[sslConfig]
sslPassword = ***

description = ABCDEFGH
peers = *
quota = MAX
stack_id = ***

description = ABCDEFGH
peers = *
quota = MAX
stack_id = forwarder

[***:ABCDEFGH]
description = ABCDEFGH
peers = *
quota = MAX
stack_id = free

[indexer_discovery]

[clustering]
cluster_label = ***
mode = manager
replication_factor = 3
search_factor = 2
pass4SymmKey_minLength = 32

what am i missing ? 

[PickleRick]

Check your config with btool. It's relatively easy to mistype pass4SymmKey (the name of the option) making it effectively not set.

[marnall]

It sounds like your bigger problem is that Splunk thinks your pass4SymmKey is empty or set to the default value.

Could you try moving the pass4SymmKey to the [clustering] stanza next to the pass4SymmKey_minLength field?

[splukiee]

@marnall  thanks . Did that , also made sure that the of pass4SymmKey & pass4SymmKey_minLength are unique across all locations , but stil the same issue 

[SanjayReddy]

Hi @splukiee 

have you changed the pass4SymmKey value under general stanza

seems you updated pass4SymmKey for clustring stanza, IMO , log message trggerting for pass4SymmKey under general 

also as suggested by @PickleRick  can you please run btool for pass4SymmKey to check different location of pass4SymmKey present on the server.

/opt/splunk/bin/splunk btool server list --debug | grep -i pass4SymmKey

[splukiee]

this is the below output i got using the command :

/opt/splunk/etc/system/default/server.conf pass4SymmKey_minLength = 12
/opt/splunk/etc/system/default/server.conf pass4SymmKey =
/opt/splunk/etc/system/default/server.conf pass4SymmKey_minLength = 12
/opt/splunk/etc/system/default/server.conf encrypt_fields = "****"
/opt/splunk/etc/system/default/server.conf pass4SymmKey = changeme
/opt/splunk/etc/system/default/server.conf pass4SymmKey_minLength = 12
/opt/splunk/etc/system/default/server.conf pass4SymmKey_minLength = 12

[splukiee]

yes both general and clustering stanza updated with pass4key and min length as well . but still the same issue . 

[askargbo]

I am having the same issue as yours. Did you ever get to solve this problem? If so, what was the solution? @splukiee 

[askargbo]

I just solved the problem by having both pass4SymmKey and pass4SymmKey_Length under the clustering stanza like below:

[clustering]

pass4SymmKey = some keys

pass4SymmKey_Length = 24

You can make your key length to be at least 12. I made mine to be 24 and my keys to be longer.