guilhemmarchand / TA-jira-service-desk-simple-addon

Atlasian JIRA add-on for Splunk alert actions
11 stars 9 forks source link

Error: JIRA Service Desk failed ticket stored for next chance replay purposes in the replay KVstore #136

Closed istutig closed 1 year ago

istutig commented 2 years ago

Hi,

This ad-on was working for me for sometime now, but recently we are able to see that everyday n number of alerts are missed on JIRA.

Using the ad-on we checked for error and some were fixed but we are not able to figure out the solution for below errors:

Kindly suggest us steps for troubleshooting.

image

Thanks in advance!

guilhemmarchand commented 2 years ago

Hi @istutig

I am looking at publishing very soon a new version, 2.0.10, which won't be affected in any way by any kind of very complex content.

The issue you have is happening due to the content submitting, can you checkout the logs please?

https://ta-jira-service-desk-simple-addon.readthedocs.io/en/latest/troubleshoot.html#add-on-logs-for-first-rest-call-attempts

When the REST call to JIRA fails, or any other exception, the addons provides additional logs which you can use to understand what is going on, this likely is due to either some weird content in your custom fields if any, or some other levels of complexity not expected

istutig commented 2 years ago

Thanks guilhemmarchand,

But I don't understand how come the content is not acceptable now. The scenario is : Lets say Alert Name is Brute Force, it was firing alerts on JIRA as expected for more than 3 months but it has recently stopped and no changes were done on Splunk as well as on JIRA end.

guilhemmarchand commented 2 years ago

Look at the logs here:

(index="_internal" OR index="cim_modactions") (source="*jira_service_desk_modalert.log")

Especially:

(index="_internal" OR index="cim_modactions") (source="*jira_service_desk_modalert.log") CASE(ERROR)

In the sentence "raw json data before json.loads" you will see the raw JSON, you can paste this in jsonlint to see where the issue stands, likely it's a content which breaks the JSON structure

istutig commented 2 years ago

Also, do we need to set up these setting as enabled or disabled?

Custom field parsing JIRA dedup behavior

image image

And as I checked the logs I can see

image

And when can we expect the upgraded version of this add-on.

guilhemmarchand commented 2 years ago

The JSON data starts from json.loads:=

Copy that JSON into jsonlint to identify where it is failing.

Custom field parsing normally avoid JSON breaking (when enabled) if you have a custom field structure.

JIRA dedup is a feature and out of the scope of your issue.

Do you have a custom field structure? Have you tried with the custom fields parsing enabled? Paste the JSON into jsonlint and you will know easily what breaks

istutig commented 2 years ago

Thanks

guilhemmarchand commented 2 years ago

@istutig

guilhemmarchand commented 2 years ago

@istutig

Would you have a chance to test a new version of the app?

https://github.com/guilhemmarchand/TA-jira-service-desk-simple-addon/releases/tag/2.0.10

istutig commented 2 years ago

Hi

Sure, I will configure it next week and will share you the update and feedback. Thanks in advance.

guilhemmarchand commented 1 year ago

Assuming all questions / issues were answered here.