Tokens not getting scrubbed?

[IanLee1521]

Hi there!

I recently was pointed to run the diagnostics.sh and scrub.sh tools by Elastic support, and after reviewing the resulting files noticed a few things that seem odd to me..

Namely, when scrubbing my kibana.log file, I found lines like:

{"grant_type":"access_token","access_token":"w/xxxxxxxxxxxxxxx"}
{"grant_type":"refresh_token","refresh_token":"w/yyyyyyyyyyyyyyyy"}

Except these have seemingly real token values in them (I replaced with the x's and y's above).

After scrubbing, those values are unchanged.

Is this a bug, or am I misunderstanding something about how the tool works? I would expect those to be modified to alternate values on scrubbing.

Cheers!

[thomheymann]

@IanLee1521 Can you share your Kibana logging configuration and what exact log events you see in Kibana after running your scripts?

[IanLee1521]

@thomheymann - way late to this.. amusingly almost exactly a year later as I'm running this again.

Is this what you were looking for from the kibana.yml file?

logging:
  appenders:
    file:
      type: file
      fileName: /usr/share/kibana/logs/kibana.log
      layout:
        type: json
  root:
    appenders: [file]

I'm actually finding that I can't seem to scrub the kibana.log file today... not sure what I was doing a year ago. Here was the re-producer for what I tried (using diagnostics version 8.5.0):

[root@axon2:diagnostics-8.5.0]# cp .../logs/kibana.log .
[root@axon2:diagnostics-8.5.0]# ./scrub.sh -i kibana.log
Using /bin/java as Java Runtime
Using -Xms8g -Xmx8g  for options.
ERROR StatusConsoleListener Unable to locate appender "diag" for logger config "root"
Processing diagnosticInputs...
Using version: 8.5.0 of diagnostic-utiliy
Deleted directory: /root/lee1001/diagnostics-8.5.0/scrubbed-kibana.
Diagnostic logger reconfigured for inclusion into archive
Threadpool configured with 64 workers.
Closing loggers.
Deleted directory: /root/lee1001/diagnostics-8.5.0/scrubbed-kibana.
Fatal error occurred: Could not scrub archive. Check diagnostics.log in the archive file for more detail.

Trouble is that there is not resulting archive file, and therefore no diagnostics.log file to look at.. Not really sure where to get more info from this tool though. Here is what scrubber.log has:

[root@axon2:diagnostics-8.5.0]# cat scrubber.log
21:51:09.377 [main] INFO  co.elastic.support.BaseService - Diagnostic logger reconfigured for inclusion into archive
21:51:09.377 [main] INFO  co.elastic.support.scrub.ScrubService - Threadpool configured with 64 workers.
21:51:09.377 [main] INFO  co.elastic.support.BaseService - Closing loggers.
21:51:09.378 [main] INFO  co.elastic.support.util.SystemUtils - Deleted directory: /root/lee1001/diagnostics-8.5.0/scrubbed-kibana.
21:51:09.382 [main] ERROR co.elastic.support.scrub.ScrubApp - Fatal error occurred: Could not scrub archive. Check diagnostics.log in the archive file for more detail.

Open to trying other things if you'd like me to take a fresh swing at tracking this down.