Having troubles with Office 365 (again ^^')

gmorin · September 28, 2022, 6:22am

Dear users of the Graylog Community, hi !

To follow-up to this thread I posted a while ago, I still have issues with Office 365 implementations.
I reinstalled a fresh Graylog Server with a small business licence in order to resolve the numerous issues I was having with my old server.

This time, I have SSL/TLS enabled. That solved nearly all the errors I was getting with the old server, like mail issues and some Office 365 related stuff.

I still have these erros in the logs, maybe some of you have already encountered theses and will provide me some useful tips ?

My config : Debian 11, latest Graylog 4.3.7, small business licence, enterprise plugins, integration plugins, enterprise integration plugins.

Here are the errors :

2022-09-27T17:14:17.874+02:00 ERROR [O365Client] O365 API request threw exception [timeout.] on attempt [22].
java.net.SocketTimeoutException: timeout
	at okhttp3.internal.http2.Http2Stream$StreamTimeout.newTimeoutException(Http2Stream.java:678) ~[graylog.jar:?]
	at okhttp3.internal.http2.Http2Stream$StreamTimeout.exitAndThrowIfTimedOut(Http2Stream.java:686) ~[graylog.jar:?]
	at okhttp3.internal.http2.Http2Stream.takeHeaders(Http2Stream.java:154) ~[graylog.jar:?]
	at okhttp3.internal.http2.Http2ExchangeCodec.readResponseHeaders(Http2ExchangeCodec.java:136) ~[graylog.jar:?]
	at okhttp3.internal.connection.Exchange.readResponseHeaders(Exchange.java:115) ~[graylog.jar:?]
	at okhttp3.internal.http.CallServerInterceptor.intercept(CallServerInterceptor.java:94) ~[graylog.jar:?]
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142) ~[graylog.jar:?]
	at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:43) ~[graylog.jar:?]
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142) ~[graylog.jar:?]
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117) ~[graylog.jar:?]
	at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.java:94) ~[graylog.jar:?]
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142) ~[graylog.jar:?]
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117) ~[graylog.jar:?]
	at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93) ~[graylog.jar:?]
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142) ~[graylog.jar:?]
	at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:88) ~[graylog.jar:?]
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142) ~[graylog.jar:?]
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117) ~[graylog.jar:?]
	at okhttp3.RealCall.getResponseWithInterceptorChain(RealCall.java:229) ~[graylog.jar:?]
	at okhttp3.RealCall.execute(RealCall.java:81) ~[graylog.jar:?]
	at retrofit2.OkHttpCall.execute(OkHttpCall.java:204) ~[graylog.jar:?]
	at org.graylog.enterprise.integrations.office365.external.O365Client.lambda$doCall$5(O365Client.java:159) ~[?:?]
	at com.github.rholder.retry.AttemptTimeLimiters$NoAttemptTimeLimit.call(AttemptTimeLimiters.java:78) ~[graylog.jar:?]
	at com.github.rholder.retry.Retryer.call(Retryer.java:160) [graylog.jar:?]
	at org.graylog.enterprise.integrations.office365.external.O365Client.doCall(O365Client.java:158) [graylog-plugin-enterprise-integrations-4.3.7.jar:?]
	at org.graylog.enterprise.integrations.office365.external.O365Client.listAvailableContent(O365Client.java:120) [graylog-plugin-enterprise-integrations-4.3.7.jar:?]
	at org.graylog.enterprise.integrations.office365.O365PollerTask.doRun(O365PollerTask.java:97) [graylog-plugin-enterprise-integrations-4.3.7.jar:?]
	at org.graylog.enterprise.integrations.office365.O365PollerTask.run(O365PollerTask.java:52) [graylog-plugin-enterprise-integrations-4.3.7.jar:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) [?:?]
	at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:305) [?:?]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:305) [?:?]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]
	at java.lang.Thread.run(Thread.java:833) [?:?]

This seems quite weird and wasn’t an error I already have before. Same goes for this :

2022-09-27T17:16:11.392+02:00 WARN  [O365Client] Client Error: [{"error":{"code":"AF20055","message":"Start time and end time must both be specified (or both omitted) and must be less than or equal to 24 hours apart, with the start time prior to  end time and start time no more than 7 days in the past. StartTime:2022-09-27T15:16:11, EndTime:2022-09-27T15:16:11"}}]
2022-09-27T17:16:11.393+02:00 WARN  [O365PollerTask] Error fetching manifest for Content Type [DLP_ALL]: [Cannot invoke "java.util.Collection.toArray()" because "c" is null.]
java.lang.NullPointerException: Cannot invoke "java.util.Collection.toArray()" because "c" is null
	at java.util.ArrayList.addAll(ArrayList.java:670) ~[?:?]
	at org.graylog.enterprise.integrations.office365.external.O365Client.listAvailableContent(O365Client.java:121) ~[graylog-plugin-enterprise-integrations-4.3.7.jar:?]
	at org.graylog.enterprise.integrations.office365.O365PollerTask.doRun(O365PollerTask.java:97) [graylog-plugin-enterprise-integrations-4.3.7.jar:?]
	at org.graylog.enterprise.integrations.office365.O365PollerTask.run(O365PollerTask.java:52) [graylog-plugin-enterprise-integrations-4.3.7.jar:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) [?:?]
	at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:305) [?:?]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:305) [?:?]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]
	at java.lang.Thread.run(Thread.java:833) [?:?]

Maybe it’s normal and/or not bad at all, but I don’t like to see red lines and errors in my log, I think you feel the same ^^

Many thanks in advance for your answers,

Have a good day

gsmith · September 28, 2022, 9:59pm

Hey @gmorin
Sorry to see your still having issues, first I havent used 0365 input but from what I see from the logs and taking a guess is this.

This seams to be a connection issue, I have seen this when using TCP/TLS or perhaps firewall.

ERROR [O365Client] O365 API request threw exception [timeout.] on attempt [22].java.net.SocketTimeoutException: timeout

Did you check date time on host and client?

WARN [O365Client] Client Error: [{“error”:{“code”:“AF20055”,“message”:“Start time and end time must both be specified (or both omitted)
and must be less than or equal to 24 hours apart, with the start time prior to end time and start time no more than 7 days in the past.
StartTime:2022-09-27T15:16:11, EndTime:2022-09-27T15:16:11”}}]

Just guessing here, but I think those error/s are producing these warnings.

2022-09-27T17:16:11.392+02:00 WARN  [O365Client] Client Error: [{"error":{"code":"AF20055","message":"Start time and end time must both be specified (or both omitted) and must be less than or equal to 24 hours apart, with the start time prior to  end time and start time no more than 7 days in the past. StartTime:2022-09-27T15:16:11, EndTime:2022-09-27T15:16:11"}}]
2022-09-27T17:16:11.393+02:00 WARN  [O365PollerTask] : [Cannot invoke "java.util.Collection.toArray()" because "c" is null.]

gmorin · September 29, 2022, 8:46am

Hi @gsmith,

I just reconfigured my NTP client, hope it’ll solve the issue !

Thanks for your fast answer

gsmith · September 29, 2022, 9:41pm

No problem @gmorin this is just a strange issue, sorry you have to go through all this.

system · October 13, 2022, 9:42pm

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Graylog Office365 input stopping Graylog Central (peer support)	5	1191	November 25, 2020
Error when trying to add an additional Office 365 input Graylog Central (peer support)	9	502	October 9, 2022
Office 365 Input Error Graylog Central (peer support)	3	710	January 27, 2021
Unable to POST (400) Graylog Central (peer support)	9	1152	December 17, 2019
Graylog Operations 5.3.2 Parsing O365 input Graylog Central (peer support)	4	149	March 4, 2024

Having troubles with Office 365 (again ^^')

Related topics