AuthStorageManagerConf [65709 SavedSearchHistoryThread] - Config entry not found.

[sgabriel1962]

AuthStorageManagerConf [65709 SavedSearchHistoryThread] - Config entry not found.   key=oauth2_external_app_client_*, operation=GET  is constantly showing up in my splunkd.log.   * is replacable by any end user name - 

Not sure where it came from and how do I get rid of it

[cswanson-vt]

Did you recently upgrade to Splunk 10.2? I did so this morning and have been getting these errors as well:

Config entry not found. key=client_<username>, operation=GET
Config entry not found. key=oauth2_external_app_client_<username>, operation=GET

I was able to stop the warning related to oauth2 by setting the following stanza and parameter in limits.conf:

[auth]

enable_oauth2_for_applications = false

This appears to be a new setting for 10.2 that defaults to true, as I understand it from the limits.conf spec. I am still seeing the top line warning above, so if anyone else has suggestions to fix that as well I'm all ears. I'm assuming it must be similar/related to the second message but I am still troubleshooting.

Cheers,

Chris

[lmaclean]

This worked as you say for the second message, but also unable to pinpoint exactly where the first one comes into play, other than getting some more details.

And even setting the server logging via the GUI for "AuthStorageManagerConf" to DEBUG does not do anything to increase the logging to try and figure out where it is coming from at all...

I would also note that "AuthStorageManagerConf" does not appear as a category in "$SPLUNK_HOME/etc/log.cfg".

Finding another channel that has a similar name of "AuthStorageManagerWithCache" and setting it to DEBUG as well from WARN now getting some more details alongside the other...

DEBUG AuthStorageManagerWithCache [123456 TcpChannelThread] - Backend operation get() failed in component=AuthStorageManagerWithCache. Error=Config entry not found. key=client_<username>, operation=GET

 Maybe the AuthStorageManagerConf message is also meant to be on log level DEBUG until they implement whatever new feature, they are trying?

So, temporary you could change the default value of "AuthStorageManagerConf" from WARN to ERROR to prevent the logs, seeing as I have not seen a single log on this channel other than this one pop-up, until the next release. Or raise a support case and see if you get a response 🙂