Splunk DB Connect - pad block corrupted

[arlombar]

I'm trying to install the splunk DB connect app in a new distributed lower environment and am running into the below error any time I enter an input:

"java.lang.RuntimeException: java.security.GeneralSecurityException: org.bouncycastle.crypto.InvalidCipherTextException: pad block corrupted"

For context, we currently have this app setup in our testing environment and I am copying over the same directories/files which include identities, connections, drivers, etc. I did create a input in our testing environment, but that file (db_inputs.conf) is not being recognized in the app on my new environment.

The other articles that I found did not appear to have a solution to problem. If anything has any advise or context to this problem, please advise.

[amartin6]

We built a new search head and added it to an existing cluster with DB Connect, before adding the new server to the load balancers we ran a dbx query and received the same error as reported here. Our fix was to retype the passwords for each identity.

[harsmarvania57]

Hi,

Have you installed Splunk DB connect on new environment and then copied identities.conf, db_connections.conf and db_inputs.conf from test environment to new environment ? If yes then it will not work because identities.conf have encrypted password and those password encryption/decryption is depend on $SPLUNK_HOME/etc/apps/splunk_app_db_connect/certs/identity.dat file and this identity.dat file will generate when you install DB Connect first time. If you want to copy identities.conf,db_connections.confanddb_inputs.conffrom test environment to this new environment then I'll suggest to copy whole app$SPLUNK_HOME/etc/apps/splunk_app_db_connect/` from test environment to new environment if new environment doesn't contain any additional DB Connections, Identities and Inputs compare to test environment.

If you don not want to copy whole app from test environment to new environment then you need to re-enter plain text password for every identities in DB Connect Web GUI and DB connect will store correct encrypted password in identities.conf

[_smp_]

Thanks, fixed me too.

[anywhere99]

Thx for the information. Just did this step to reenter the password but I needed to recreate all the identities manually then it worked.

[arlombar]

Thanks for your advise. I tried originally using your method of pulling the entire directory/app from my other environment and adding this directly onto my new boxes, but I am running into another error now:

"Cannot communicate with task server, please check your settings."

My impression is that this is related to the JRE, however this is the same JDK/JRE that I have installed on the working environment...

When moving these app between environments, is it recommended to just install base copies where needed then add in the conf files later or even manually add them as an entry into the UI? This is the only app so far I've ever had an issue like this when moving between environments.

[harsmarvania57]

For Task Server error, can you please check below points ?

1. Check any error in $SPLUNK_HOME/var/log/splunk/splunk_app_fb_connect_*.log
2. Check JRE path on server, there might be possibility that JRE installed in test environment and new environment has different paths and due to copying entire app from test to new environment it is causing an issue, you can set JRE path in $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/dbx_settings.conf
3. Check Task Server Port is occupied by any other process/application on new server ?

[arlombar]

Splunk v7.0.4
Splunk DB connect v3.1.4