Error getting assets for event: sha512 does not match

Sensu Go
,
1

error getting assets for event: sha512 does not match

Hi Team,
Please help here, we are facing this issue all of sudden here mismatch between asset key.
Even though we have updated properly in the asset and which will download from s3 bucket.
Its not matching with asset key and in the sensu backend and always it will generate new one from sensugo.
Even we tried to upgrade sensugo backend to 5.21.3, but still the issue is same here.
Is this bug at your side?.. please help here, due to this non of our checks are not running and blocked our production.

ERROR:
error getting assets for event: sha512 ‘62fdcdcc411b95e7b05317f55777ddd89wfhejbgherbgrbgi4u5932u20ff52af6ef39835d9e’ does not match specified sha512: ‘7hrhgeirbvure39757836928udwdnlwko2y366565392nds’

Example for Asset Definition:
=== proc-rfc
Name: proc-rfc
Namespace: proc
URL: https://bucket.s3.amazonaws.com/bucket_name/folder1/bin.tar.gz
SHA-512 Checksum: 8b274d235b94c7da626069e8306395678b4f8b506233b84fe035094947e0aeac75e0d7ec42c29014a84a0f19fc56e029314df5f1a9d05f68a6f2032c41e2f4d0
Filters:

2

@palourde @jspaleta
Could someone please help here
Already raised a github issue as well #4117
Thanks in advance.

3

Hi @kopal_gupta

Could you provide us the asset definition in question? Also, you could try to manually download the asset defined and calculate its checksum (e.g. https://www.computerhope.com/unix/sha512sum.htm).

Thanks

4

Hey,
So those shasum’s are not valid… im assuming those are manually garbled for security reason…

But the most likely culprit is you’ve somehow run out of diskspace in the /tmp/ directory where the assets are downloaded, prior to being validated. If you run out of diskspace, the download probably doesnt complete and then the shasum won’t validate.

5

Hey @palourde Thanks for the response.
Here is the asset definition
=== proc-rfc
Name: proc-rfc
Namespace: proc
URL: https://bucket.s3.amazonaws.com/bucket_name/folder1/bin.tar.gz
SHA-512 Checksum: 8b274d235b94c7da626069e8306395678b4f8b506233b84fe035094947e0aeac75e0d7ec42c29014a84a0f19fc56e029314df5f1a9d05f68a6f2032c41e2f4d0
Filters:

Also,
var/cache/sensu/sensu-agent # ls -la
total 44
drwxr–r-- 2 root root 39 Dec 9 04:52 .
drwxr–r-- 3 root root 25 Dec 9 04:52 …
-rw------- 1 root root 16384 Dec 9 04:52 assets.db
-rw------- 1 root root 32768 Dec 9 04:52 queue.db
and in sensu agent cache also not seeing its downloading

6

Thanks @jspaleta for the response, I checked there is no issue with the diskspace.
Also,
var/cache/sensu/sensu-agent # ls -la
total 44
drwxr–r-- 2 root root 39 Dec 9 04:52 .
drwxr–r-- 3 root root 25 Dec 9 04:52 …
-rw------- 1 root root 16384 Dec 9 04:52 assets.db
-rw------- 1 root root 32768 Dec 9 04:52 queue.db
and in sensu agent cache also not seeing its downloading

7

Hey,
It’s difficult to help diagnose a private asset that I can’t download myself. The url in your asset definition above is invalid( it looks like a placeholder from amazon s3 example instructions). I can only assume you’re deliberately faking the url for security reasons and don’t want to make the real asset url public in this forum. Which is completely understandable, but it does make it difficult for us to help you diagnose the problem on your end as we can’t download the asset ourselves to test without our systems.

There are three potential problems that you need to look at on your end. I’m unable to do any of the following to help you confirm because I don’t have a valid asset url for your asset.

  1. is the asset url in the asset resource a valid tar.gz file?
    The url you have provided us looks like a placeholder and not a real S3 url. You need to confirm manually that you can download the asset using the real url manually via curl or wget and ensure its a valid tar.gz with the contents you expect.
  2. is the sha512 in the asset resource correct?
    one you have manually downloaded the asset and confirmed its what you expect, you should manually confirm the sha512 you have in the asset definition is correct using sha512sum command.
  3. is there appropriate space available in /tmp for the asset to be successfully downloaded?

Hope this helps.

8

@jspaleta , Thanks for the detailed response, Yeah for security reasons had transform the URL, and we are able to download the asset manually using CURL command, and SHA getting generated is a valid one.

9

Hi @kopal_gupta

The asset’s checksum you defined is 8b274d235b94c7da626069e8306395678b4f8b506233b84fe035094947e0aeac75e0d7ec42c29014a84a0f19fc56e029314df5f1a9d05f68a6f2032c41e2f4d0

However the error messages you provided us do not contain this checksum; in fact, these checksums do not even appear to be valid SHA512 checksums because of their length. In the error message, I’d expect the first checksum to match whatever you defined in your asset definition.

From this point, I’d recommend to inspect your agent’s logs, make sure this is the asset you are expecting, and maybe start considering upgrading your agents & backend to Sensu Go 6.x.

Without more information there’s not a lot we can do on our side unfortunately.

10

Sure, will try that approach. Thanks @palourde