IT32914: X-FORWARDED-FOR HEADER SHOULD BE SANITIZED FOR CORRECT ANALYTICS DATA

Fix packs for DataPower Gateway version 2018.4.1
Fix packs for DataPower Gateway version 10.0.1.x

APAR status

• Closed as program error.

Error description

• in analytics kibana we have an index defined with client IP
  field in certain format. But the Azure WAF is sending the
  client IP in a different format and hence APIC parsing is
  failing to show up on the APIC Analytics portal.
  The data is all there, it just doesn't show up on the portal.
  Example:
  [2020-05-
  07T05:25:31,751][WARN
  ][logstash.outputs.elasticsearch] Could
  not index event to Elasticsearch.
  {:status=>400,
  :action=>["index", {:_id=>nil,
  :_index=>"apic-api-w",
  :_type=>"apievent",
  :_routing=>nil}, #?<LogStash::Event:0x6f2a9
  30d>],
  :response=>{"index"=>{"_index"=>"apic-api-2020.05.06-000
  090",
  "_type"=>"apievent",
  "_id"=>"AXHtmJPeXDd0lV35y4cD",
  "st
  atus"=>400,
  "error"=>{"type"=>"mapper_parsing_exception",
  "rea
  son"=>"failed to parse [client_ip]",
  "caused_by"=>{"type"=>"ill
  egal_argument_exception",
  "reason"=>"'73.73.125.237:56813' is
  not an IP string
  literal."}}}}}
  

Local fix

Problem summary

• APIC might not capture a transaction in analytic log.
  

Problem conclusion

• Fix is available in 2018.4.1.12 and 10.0.0.0
  For a list of the latest fix packs available, please see:
  https://www.ibm.com/support/pages/node/83105
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DATAPOWER

• Fixed component ID

  DP1234567

Applicable component levels

• R100 PSY

     UP

• R18X PSY

     UP