Solutions

Error when creating audit logging handler in DS (All versions) which stops the server responding or restarting

Last updated Nov 17, 2019

The purpose of this article is to provide assistance if you experience issues creating an audit logging handler in DS. Afterward, DS stops responding and/or fails to restart. This issue affects all handlers that require a JSON configuration file (Elasticsearch, JDBC, JMS, JSON stdout, Splunk and Syslog).


Symptoms

The following response is received when trying to create an audit logging handler using the dsconfig command:

The External Access Log Publisher could not be created due to a communications
problem: Other: The attempt to apply the configuration add failed. The
preliminary checks were all successful and the entry was added to the server
configuration, but at least one of the configuration add listeners reported an
error when attempting to apply the change: Error while creating or updating
common audit log publisher cn=Splunk LDAP Access Log Publisher,cn=Loggers,cn=config:
org.forgerock.opendj.config.server.ConfigException: Error while creating
common audit external log publisher cn=Splunk LDAP Access Log
Publisher,cn=Loggers,cn=config: org.forgerock.audit.AuditException: Unable to
retrieve json value from json input stream

After attempting to create the audit logging handler, DS stops working and/or fails to restart. You will see an error similar to this in the server.out log file when this happens:

[10/Oct/2019:11:09:58 +0000] category=CORE severity=NOTICE msgID=139 msg=The Directory Server has sent an alert notification generated by class org.opends.server.core.DirectoryServer (alert type org.opends.server.DirectoryServerShutdown, alert ID org.opends.messages.core-141): The Directory Server has started the shutdown process. The shutdown was initiated by an instance of class org.opends.server.core.DirectoryServer and the reason provided for the shutdown was An error occurred while trying to start the Directory Server: ConfigException: Error while creating or updating common audit log publisher cn=Splunk LDAP Access Log Publisher,cn=Loggers,cn=config: org.forgerock.opendj.config.server.ConfigException: Error while creating common audit external log publisher cn=Splunk LDAP Access Log Publisher,cn=Loggers,cn=config: org.forgerock.audit.AuditException: Unable to retrieve json value from json input stream (CommonAudit.java:241 AbstractLogger.java:427 AbstractLogger.java:206 LoggerConfigManager.java:238 DirectoryServer.java:1437 DirectoryServer.java:5048)
[10/Oct/2019:11:09:58 +0000] category=CORE severity=NOTICE msgID=203 msg=The Directory Server is now stopped

Recent Changes

Created an audit logging handler in DS.

Causes

The JSON configuration file has errors. The most common issue is that it still contains comments. As noted in the sample configuration files:

// Strip comments before use with grep -v '^[ ]*//' < your-file.json

Solution

This issue can be resolved by ensuring the JSON in the configuration file is valid and all comments have been removed. You can remove comments using the grep command indicated in the sample file:

$ grep -v '^[ ]*//' < file_name.json

Once you have corrected your file, you should restart the DS server.

See Also

How do I configure DS (All versions) and OpenDJ 3.x to use the Syslog audit event handler?

Administration Guide › Access Logs

Related Training

N/A

Related Issue Tracker IDs

N/A



Copyright and TrademarksCopyright © 2019 ForgeRock, all rights reserved.

Recommended Books

Loading...