Publisher ID is not set
jjkoster opened this issue · 9 comments
When using o365beat I receive the error:
{"code":"AF429","message":"Too many requests. Method=GetContents, PublisherId=00000000-0000-0000-0000-000000000000"}
It looks like Publisher ID is not set from the config file from directory_id so the request get rate limited with the other 00000 etc Publisher IDs being used. I believe Publisher ID can be arbitrary from other Azure AD API scripts I have used.
My current config looks like this (hard coded values):
tenant_domain: removed
client_secret: removed
client_id: removed # aka application id (GUID)
directory_id: removed # aka tenant id (GUID)
registry_file_path: ./o365beat.state
I have tried to set the directory as an environment variable as well.
Thanks for any help.
Thanks for the feedback! Could you confirm which version you're using, on which platform, and what calls are getting throttled? We fixed a version of this in a063d06, it should be properly appended to all throttle-able calls for a while now, but I might have missed one!
If you'd prefer to send logs or other info via email, you can reach me at chris@counteractive.net. Thanks again!
Hi Chris,
I'm using 7.4.0, on Oracle Linux 7.6
The throttled request is for contenttype=Audit.AzureActiveDirectory
If you need more info, I'll send to your email address.
Sorry version 1.4.2
That's the current version, so there's definitely something else going on. To diagnose I'll need to see the logging output with all the debugging on, you can log to stderr (on the command line) with:
# and whatever other flags you're using when you have the issue
./o365beat -e -d "*" Please send as much of that output via email as you can, and if you could send your config file too (you can of course remove anything sensitive), that'll help. Thanks so much for reaching out, I'm looking forward to sorting out what's going on!
Sure enough, it turns out some tenancies can be so busy that even asking what content is available gets throttled! Thank you for reporting the issue, it should be a straightforward fix: every API call needs PublisherIdentifier appended, not just the high-volume calls. Sorry for not catching that sooner, we'll get it pushed in a new version this week.
@jjkoster: I pushed the Publisher ID into all API requests, so you shouldn't see this error once we issue a new release. I'm going to try to include a couple other fixes before we push that out, but it should be very soon. Thanks again for the feedback!
Thanks Chris, looking forward to it.