This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

SWIS JSON Endpoint - Connection reset by peer

cgevans over 7 years ago

Hi All,

I'm attempting to pull some data from the SWIS JSON endpoint but a curl request just sits there until it eventually times out and the connection is reset.

The client and server firewalls are off and I can see my connection ESTABLISHED on the server side until it times out. Even on the server itself using 127.0.0.1 it still establishes and then times out after about 2 minutes.

curl -k -u admin:password -X GET -H "Content-Type: application/json" nms:17778/.../Query

<2 Mins.....>

curl: (56) Recv failure: Connection reset by peer

I tried the HTTPS version to start with, but that's rejected immediately with 'Unknown SSL protocol error in connection' error. With HTTP it connects, but then nothing happens.

SWQL Studio connects on either HTTP or HTTS and works fine, including for the SELECT statement I'm trying with curl (above).

There doesn't seem to be anything in the logs (C:\ProgramData\Solarwinds\InformationService\v3.0\Orion.InformationService.log) related to my query. There doesn't seem to be anything in the Windows logs.

The server has also been rebooted (you never know, right?).

Should the API respond on HTTP, or do I need to sort the HTTPS issue?

This is in the log when HTTPS is tried... An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.

Here's the verbose curl output for a slightly different query that was posted in this thread Upgraded server. Python API broken, PowerShell working by SolarWinds as a test.

$ curl -k -v -u admin:SCRUBBED "localhost:17778/.../Query"

* STATE: INIT => CONNECT handle 0x600057500; line 1108 (connection #-5000)

* Added connection 0. The cache now contains 1 members

* Trying ::1...

* STATE: CONNECT => WAITCONNECT handle 0x600057500; line 1161 (connection #0)

* Connected to localhost (::1) port 17778 (#0)

* STATE: WAITCONNECT => SENDPROTOCONNECT handle 0x600057500; line 1260 (connection #0)

* STATE: SENDPROTOCONNECT => DO handle 0x600057500; line 1278 (connection #0)

* Server auth using Basic with user 'admin'

> GET /SolarWinds/InformationService/v3/Json/Query?query=SELECT+TOP+5+Caption+FROM+Orion.Nodes HTTP/1.1

> Host: localhost:17778

> Authorization: Basic SCRUBBED

> User-Agent: curl/7.48.0

> Accept: */*

* STATE: DO => DO_DONE handle 0x600057500; line 1357 (connection #0)

* STATE: DO_DONE => WAITPERFORM handle 0x600057500; line 1484 (connection #0)

* STATE: WAITPERFORM => PERFORM handle 0x600057500; line 1494 (connection #0)

Anyone have any ideas?

Thanks,

Carl

0 cgevans over 7 years ago

Update:
As mentioned in the thread Upgraded server. Python API broken, PowerShell working , HTTP is not supported, (even though it connects).
So, this made me look into the SSL issue. The best method would be to get TLSv1.2 working on the server, but this is apparently not supported in the current release version. Adding '-1 --tlsv1.0' to the curl request to force the version down to TLSv1.0 returns valid JSON. So, for now we'll use TLS 1.0 in the Python requests until SolarWinds supports TLS 1.2.
Cancel
Vote Up 0 Vote Down

Cancel
0 tdanner over 7 years ago in reply to cgevans

What version of the product do you have installed? And what version of .NET on the Orion server?
Cancel
Vote Up 0 Vote Down

Cancel
0 cgevans over 7 years ago in reply to tdanner

Orion Platform 2015.1.2, QoE 2.0, IPAM 4.3, NCM 7.3.2, NPM 11.5.2, NTA 4.1.2, UDT 3.2.2, IVIM 2.1.0
The Orion Application Pool in IIS is using .NET v4.0.
Is there any way to get it to support TLSv1.2, or is that in the next version?
Cancel
Vote Up 0 Vote Down

Cancel
0 tdanner over 7 years ago in reply to cgevans

Do you have .NET 4.5 installed?
Cancel
Vote Up 0 Vote Down

Cancel
0 cgevans over 7 years ago in reply to tdanner

Just v4.0.30319. I can install v4.5 though and switch the app pool over if that will help?
I've been looking at this as well...
HTTPS Monitor and SSL Certificate Expiration Date Monitor reports down status when TLS 1.0 disabled on monitored IIS ser…
I tried to disable TLS v1.0 with the Nartac tool, but SolarWinds didn't seem to come back up properly. I haven't done the registry or hotfix parts though. This is installed on Windows Server 2012 Standard.
Cancel
Vote Up 0 Vote Down

Cancel
0 cgevans over 7 years ago in reply to cgevans

Actually, looking at the installed features, 4.5 is already installed.
Joymon V/S Code: How to make .Net 4.0 & 4.5 use TLS 1.2
TLS 1.2 is enabled by default in 2012, but support from the .NET side only starts in version 4.5. To get 4.0 applications to use the 4.5 system.dll and therefore support TLS 1.2 you can add that registry key mentioned in the other thread (below). I have added it to both 32bit and 64 bit registry keys.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001
Unfortunately still no joy. Still getting the following in the server log from Schannel:
An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
This post is almost identical to our issue..
Upgraded server. Python API broken, PowerShell working
Cancel
Vote Up 0 Vote Down

Cancel