Security

Why does setting HTTPS_PROXY in Splunk 6.4.0 cause the web server to crash (500 - Internal Server error)?

szabados
Communicator

I'm running 6.4.0. The HTTP_PROXY variable was configured in my splunk-launch.conf, and later I've configured the HTTPS_PROXY as well. After restarting Splunk, I'm prompted for login, but no other page can be loaded after that. (500 - Internal Server error).

How can I get the HTTPS proxy to work?

0 Karma
1 Solution

aosso
Path Finder

Hi,

There's a known issue for version 6.4.0 related to HTTPS_PROXY:

http://docs.splunk.com/Documentation/Splunk/6.4.0/ReleaseNotes/KnownIssues#Highlighted_issues

HTTPS_PROXY in splunk-launch.conf causes 500 Internal Server Error after login. To work around this issue:
Option 1: Export the following setting into your environment prior to starting Splunk Enterprise: NO_PROXY="127.0.0.1,localhost,[::1]"

export NO_PROXY="127.0.0.1,localhost,[::1]"
or add it to $SPLUNK_HOME/etc/splunk-launch.conf and restart Splunk Enterprise.

Option 2: Unset the proxy on the Linux system and restart Splunk Enterprise:

echo $http{,s}_proxy
unset http{,s}_proxy 
If the proxy is set in splunk-launch.conf but is not actually used or needed, remove the setting and restart.

This was fixed on 6.4.1, I'd consider doing an upgrade.

http://docs.splunk.com/Documentation/Splunk/6.4.1/ReleaseNotes/6.4.1

2016-04-12  SPL-117139  HTTPS_PROXY environment variable set causes 500 Internal Server Error after login.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Some folks have suggested a reboot was required. Have you tried clearing your cache with ctrl + f5?

0 Karma

szabados
Communicator

Tried both but no luck

0 Karma

jkat54
SplunkTrust
SplunkTrust

Also if it's linux, it appears you can just set the environmental variables https_proxy or http_proxy.

https://answers.splunk.com/answers/2670/set-a-proxy-variable-for-splunk-to-get-out-to-the-internet.h...

Finally, I wonder if https_proxy is even needed, or if it works without http_proxy also being specified.

Hopefully this gives you some ideas to try.

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

Pretty sure that link is regards to having the Splunk server (script or some modular input) be able to go out to the internet via a proxy server.

If you are putting a proxy server in front of splunkweb (for something like SSO) you should take a look at the web.conf.spec file for the appropriate settings.

0 Karma

aosso
Path Finder

Hi,

There's a known issue for version 6.4.0 related to HTTPS_PROXY:

http://docs.splunk.com/Documentation/Splunk/6.4.0/ReleaseNotes/KnownIssues#Highlighted_issues

HTTPS_PROXY in splunk-launch.conf causes 500 Internal Server Error after login. To work around this issue:
Option 1: Export the following setting into your environment prior to starting Splunk Enterprise: NO_PROXY="127.0.0.1,localhost,[::1]"

export NO_PROXY="127.0.0.1,localhost,[::1]"
or add it to $SPLUNK_HOME/etc/splunk-launch.conf and restart Splunk Enterprise.

Option 2: Unset the proxy on the Linux system and restart Splunk Enterprise:

echo $http{,s}_proxy
unset http{,s}_proxy 
If the proxy is set in splunk-launch.conf but is not actually used or needed, remove the setting and restart.

This was fixed on 6.4.1, I'd consider doing an upgrade.

http://docs.splunk.com/Documentation/Splunk/6.4.1/ReleaseNotes/6.4.1

2016-04-12  SPL-117139  HTTPS_PROXY environment variable set causes 500 Internal Server Error after login.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.