Unlock a world of possibilities! Login now and discover the exclusive benefits awaiting you.
Hi,
I was checking the performance of our server today and I noticed something weird in the operations monitor.
Every hour, our serviceuser tries to access something which I cannot find on the server. Any idea how I can find this and end this type of behaviour?
Service user has a valid User access pass.
Strange enough our Monitoring app reload at the exact same time.
Don't know if that is coincedence or not.
Kind Regards,
Isabelle Timmermans
Proxy | ERROR | Access to app '__hub' denied, result code 'NoAvailableAccessType' | 4.425 | 2019-03-27 07:54:43 |
Repository | ERROR | Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '5e74cee8-efc0-46ce-a62a-8c13551d5a05', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied' | 1 | 2019-03-27 07:54:43 |
Repository | ERROR | Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: 'bff39228-5bf7-4fcc-ba75-b920d44f5662', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied' | 1 | 2019-03-27 07:54:41 |
Proxy | ERROR | Access to app 'object' denied, result code 'NoAvailableAccessType' | 632 | 2019-03-27 07:54:34 |
Repository | ERROR | Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '746651d9-3b66-4568-9115-9ce4ad26c343', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied' | 1 | 2019-03-27 07:54:34 |
Proxy | ERROR | Access to app 'full' denied, result code 'NoAvailableAccessType' | 1.264 | 2019-03-27 07:54:33 |
Repository | ERROR | Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '5c3bca75-b5a2-4308-b6d1-b5e5e42da87c', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied' | 1 | 2019-03-27 07:54:33 |
Repository | ERROR | Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '27c97373-3f67-43d2-88d1-39f6038fd849', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied' | 1 | 2019-03-27 07:54:30 |
Repository | ERROR | Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '18a4e0b6-abaf-4d15-a917-d35745e9155e', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied' | 1 | 2019-03-27 07:53:32 |
Repository | ERROR | Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '37436f9d-2476-4aec-81a1-6a32d736fb8f', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied' | 1 | 2019-03-27 07:53:31 |
Repository | ERROR | Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '6de1f735-4c05-4074-a2a7-1a24574edbe7', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied' | 1 | 2019-03-27 07:53:28 |
Repository | ERROR | Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '4b236f45-2982-43b3-8ab2-a41b0a056bd4', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied' | 1 | 2019-03-27 07:53:27 |
Repository | ERROR | Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '763be4ea-f913-468b-b0a7-c785e85a10b9', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied' | 1 | 2019-03-27 07:53:26 |
Repository | ERROR | Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: 'f9a9b74c-7b73-48fe-91bc-7ed98dadfe72', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied' | 1 | 2019-03-27 06:54:43 |
Repository | ERROR | Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '3cd532ad-aa04-4c54-b7eb-52f8de9ec5d3', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied' | 1 | 2019-03-27 06:54:41 |
Hello,
This is not a coincidence that you observe this behavior while the monitoring applications are reloading.
Starting from Qlik Sense April 2018, when reloading the monitoring application, there are several calls against the Qlik Sense Proxy API using the rest connector.
The difference with the behavior prior to Qlik Sense April 2018 is that now, the user doing those API calls (By default the Qlik Sense Service account) is now opening parallel active sessions.
So you are likely to experience this issue if you try to access the Qlik Sense Hub with the Qlik Sense Service account after a reload of the monitoring application. You will get an error saying that you have no access pass for your users.
The recommendation as of Qlik Sense April 2018 is to not allocate an access pass to the Qlik Sense Service account or to create a dedicated user (without a token) and modify the Monitoring Apps Data Connector (monitor_*) to run with this new user (Note, the user running those data connections needs to be RootAdmin).
Additional information available here: https://support.qlik.com/articles/000051633
Hope this helps!
Hi Patrick,
I have absolutely no idea if and how I solved it...
Kind regards,
Isabelle
Did you check the article that @Bastien_Laugiero attached to this post?
The resolution there is
The article also explains why this happens
Hello @Maria_Halley
Yes, I saw his post. It is from 2018 therefore I thought there could be another solution.
One big question, what do you understand as a 'dedicated user'.
Which rights should this user have?
Thank you. Best regards, Patrick
The solution is still the same.
What we mean a dedicated windows user that runs the services, but never logs in to QlikSense.
@Maria_Halley
Thank you.
I checked the data connections (monitor_*) and all have the service user as "User ID". And the serviceuser does not have a license.
Do you have another idea what I could check?
Thank you.
Hi
Did you manage to make any progress on this subject?
I also see the errors when Operations Monitor runs and similarly the service account does not have a licence assigned and is a Root Admin.
All data connections "monitor_apps_REST_*" show User ID as the service account.
There is additionally a data connection "monitor_apps_qlikview_logs" which shows in Data Connections when viewing script of apps. This does not have the service account as User ID but the service account does have CRUD user access.
Thanks
Same here.
The Qlik services run under a service account (LDAP user) and this user is RootAdmin in Qlik Sense without a license (he used to have one, but it was removed).
When the ServiceUser still had the license he could not query the Rest API due to SessionCounts >5.
Now that he no longer has a licence he can't because the error message is UsageDenied.