Graylog2 / Graylog2/graylog-plugin-aws

Improved handling of unnecessary Cloudtrail messages

Open
#666 1 comment 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
93
Forks
37
PR merge metrics
No merged PRs in 30d

Description

While setting up the Cloudtrail input, customer noted the following ERROR in their server.log:

`2022-10-27T13:27:38.655-04:00 ERROR [CloudtrailSNSNotificationParser] Parsing exception.
com.fasterxml.jackson.core.JsonParseException: Unrecognized token 'CloudTrail': was expecting ('true', 'false' or 'null')
at [Source: (String)"CloudTrail validation message."; line: 1, column: 11]
at com.fasterxml.jackson.core.JsonParser._constructError([JsonParser.java:1804](http://jsonparser.java:1804/)) ~[graylog.jar:?]`

Per https://github.com/Graylog2/graylog-plugin-aws/issues/80 the Cloudtrail input will skip processing/continue executing past messages it does not understand, and per https://github.com/Graylog2/graylog-plugin-aws/issues/249 we acknowledge that this is an unnecessary message.

However, this negatively impacts the customer experience by adding ERROR lines to their server.log with a scary-looking stack dump, and if customer is attempting to set up the Cloudtrail input, will be mindful of log lines that we specify to be ERROR.

A more ideal situation would be to parse the message type, and present something like "Cloudtrail validation message encountered, skipping processing for unnecessary message." at reduced log priority than ERROR.

[HS-1155337333](https://app.hubspot.com/contacts/8267556/ticket/1155337333)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.