I want to list logs the user name and "Authentication Failed" keywords in the message.
if I send to elasting search following query ;
{"query":
{"bool":
{"must": [
{"match": {"message": "Common.Username=AB001"}},
{"match":{"message":"Authentication Failed"}}
]
}
}
}
records are listed, but old records are listed, not new ones
Forexample, following records are returning ;
timestamp=2022-04-21 13:10:37+03,Common.Username=AB001,MSCHAP:
Authentication failed timestamp=2022-04-22
13:10:37+03,Common.Username=AB001,MSCHAP: Authentication failed
timestamp=2022-04-26 13:10:37+03,Common.Username=AB001,MSCHAP:
Authentication failed
but the records I'm waiting for are ;
timestamp=2022-04-29 10:10:37+03,Common.Username=AB001,MSCHAP:
Authentication failed timestamp=2022-04-29
12:10:37+03,Common.Username=AB001,MSCHAP: Authentication failed
timestamp=2022-04-29 13:10:37+03,Common.Username=AB001,MSCHAP:
Authentication failed
so when I prepare a query like the following, I also;
{
"query":
{"bool":
{"must": [
{"match": {"message": "Common.Username=AB001"}},
{"match":{"message":"Authentication Failed"}}
]
}
},"sort" : [
{"#timestamp" : {"order" : "desc"}}
]
}
It fetches all records without taking into account the values "AB001" and "Authentication Failed"
timestamp=2022-04-29 10:10:37+03,Common.Username=BBB01,MSCHAP:
Account locked out timestamp=2022-04-29 13:10:37+03,Common.Username=AB001,MSCHAP: Account locked out
timestamp=2022-04-29 12:10:37+03,Common.Username=BBBB,MSCHAP:
Authentication failed timestamp=2022-04-29
13:10:37+03,Common.Username=CCCC,MSCHAP: Authentication failed
how can I get records containing keywords (Username and "Authentication Failed") in date order
Related
Is it possible to create a ToDo-Task for other users using a single Admin login?
I have registered an app, and set "API permissions" for Tasks.Read, Tasks.ReadWrite, User.Read.All
I have two users. An admin user, and a test user.
I acquire an access_token for the admin user:
Using the admin's access token as Auth Header "Bearer {{token}}", I can read the test user's profile with GET https://graph.microsoft.com/v1.0/users/testuser#mycompany.onmicrosoft.com
I can successfully create a ToDo-Task for the test user using the test user's access token.
I can successfully create a ToDo-Task for the admin user using the admin user's access token.
However, if I try to create a ToDo-Task for the test user with the admin's access token, I receive this error message ({{ListID}} = List-ID of the test user):
{
"error": {
"code": "invalidRequest",
"message": "Invalid request",
"innerError": {
"code": "ErrorIncorrectRoutingHint",
"date": "2022-07-28T07:49:25",
"request-id": "#######-####-####-####-############",
"client-request-id": "########-####-####-####-############"
}
}
}
What you need is application permission, however, Graph ToDo tasks API is not yet supported.
For more information, check document:https://learn.microsoft.com/en-us/graph/api/resources/todo-overview?view=graph-rest-1.0
A few hours ago I was able to access my default storage bucket without any problems. However, now I can't. I receive the following message:
Error Domain=FIRStorageErrorDomain Code=-13021 "User does not have permission to access gs://MY_BUCKET_NAME/data.json." UserInfo={object=data.json, ResponseBody={
"error": {
"code": 403,
"message": "Permission denied. Could not perform this operation"
}
Here's my bucket rules:
rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /{allPaths=**} {
allow read, write: if request.auth != null;
}
}
}
I don't know what to do. Can someone help?
Note: I'm on the Blaze plan. firebase-storage#system.gserviceaccount.com is added to my default Firebase Storage bucket.
Your rules require that a user be signed into your app in order to read or write any file in the bucket. I would expect that the only reason why you would get that message is if there was no user signed in, or somehow you are trying to access a bucket that is not in the same project as the signed in user.
I am using the Code flow ... with scope of "onedrive.readonly onedrive.appfolder"
I get the code, then the token, and when I try to get the information about the user:
https://graph.microsoft.com/v1.0/me
In java I set the following headers to the request:
uc.setRequestProperty("Content-Type", "application/json");
uc.setRequestProperty("Authorization", String.format("Bearer %s", mSessionInfo.BearerToken));
I get the error:
{ "error": {
"code": "InvalidAuthenticationToken",
"message": "CompactToken parsing failed with error code: 8004920A",
"innerError": {
"request-id": "b8959569-efd0-4575-947e-c8835f8fef93",
"date": "2018-08-29T15:46:53"
} } }
What does this error mean ? How to proceed ?
The response actually indicates that the access token was not successfully generated or passed to the graph endpoint. Microsoft Graph couldn't parse it as a JWT token and thus attempted to process it as a Microsoft Account/Live Id compact token, which also failed. Please check the response that you got from the call to login.microsoftonline.com and that the token passed to graph.microsoft.com is a valid JWT token.
When trying to retrieve data from a v1.0 report endpoint on a demo tenant, for example:
https://graph.microsoft.com/v1.0/reports/getOffice365ActiveUserCounts(period='D7')
I get this strange result:
{
"error": {
"code": "UnknownTenantId",
"message": "We do not recognize this tenant ID 3d64a....7279c0. Please double-check the tenant ID and try again.",
"innerError": {
"request-id": "7b7b8....8029b",
"date": "2018-04-30T09:32:46"
}
}
}
Instead of an HTTP 302 redirection to get the CSV report results (according to the doc).
I'm trying from Graph API Explorer, authenticated as tenant admin account, this has worked as expected before tenant expiration + extension (a few hours ago)
I will try in a few hours again, tomorrow etc. (I'll write the results here) because this error looks to be related to tenant expiration (or else, what is happening?)...
Hello I am getting several skip token errors when running a full import on the graph API.
here is the error
The following one looks like expiration of skiptoken. Graph connector uses skip token in different cases. I would communicate with Graph API team to understand if this is correct behavior for the API.
Message: Error during http call. HttpStatusCode: BadRequest;
url: https://graph.microsoft.com:443/v1.0/groups/5802115b-ef14-4572-bec1-9a4747e5bcfb/members/?$select=id&$skiptoken=X%2744537074090001000000000000000010000000D6203A9D758C6F4B887B307BA3302EB5000000000000000000000017312E322E3834302E3131333535362E312E342E323333310000000000000157F232736047814E848C20B3547FF5E8%27;
Response: {
"error": {
"code": "Directory_ExpiredPageToken",
"message": "The specified page token value has expired and can no longer be included in your request.",
"innerError": {
"request-id": "1489b123-f94c-4531-82d1-d4b76331e3eb",
"date": "2017-11-27T18:59:23"
}
}
}
Message: Error during http call. HttpStatusCode: Unauthorized;
"code": "Authentication_MissingOrMalformed",
"message": "Access Token missing or malformed.",
The application has full control over all objects so it should not get an error with permissions issues