Stackdriver Logging - User unauthorized

[peter...@cjcit.com]

Hi All,

I am setting up google-fluentd so I can forward my logs through the StackDriver solution through to a pub/sub that a server somewhere can read however, I am getting the below error.

2019-04-10 13:37:35 +0000 [warn]: #0 Dropping 2 log message(s) error="User unauthorized to access 764086051850" error_code="7"

I've given the VM and the Service Account permissions to Stackdriver Logging API and have ensured this API is enabled.

Have attached screenshots showing API enabled, and all the other permissions.

Any ideas how to resolve this issue? I've tried reinstalling the API.

I've also tried setting the $GOOGLE_AUTHENTICATION_CREDENTIALS with the service accounts JSON key but no luck.

One thing to note is the below log message from /var/log/messages, not sure why its saying this when using a service account.

Apr 10 13:37:04 test-1 google-fluentd: Starting google-fluentd 1.6.6: Your application has authenticated using end user credentials from Google Cloud SDK. We recommend that most server applications use service accounts instead. If your application continues to use end user credentials from Cloud SDK, you might receive a "quota exceeded" or "API not enabled" error. For more information about service accounts, see https://cloud.google.com/docs/authentication/.

Apr 10 13:37:04 test-1 google-fluentd: [  OK  ]#015google-fluentd[  OK  ]

Thanks!

Peter

[Igor Peshansky]

Please follow the steps at https://cloud.google.com/logging/docs/agent/troubleshooting, especially those related to credentials, to ensure that your agent is authorized correctly. On GCE you'd normally use the VM's default service account via the application default credentials token, which would ensure that you're writing to the same project the VM is running in. From the error, it looks like you may have downloaded the end-user credentials (client_secrets.json) instead of the service account private key (application_default_credentials.json). Moreover, since the agent is extracting the project from the credentials file if one is present, it's possible that you're attempting to write the logs to the wrong project because the service account was not created in the same project that runs the VM (as outlined in the troubleshooting steps). But I would first try to run the agent with no extra credentials altogether (see the first note in the authorization guide).

Hope this helps. If you are still having trouble and need us to look at the specific details of your project, your best bet is to open a support case with Google Cloud Support.

        Igor

--
© 2016 Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043
 
Email preferences: You received this email because you signed up for the Google Stackdriver Discussion Google Group (google-stackdr...@googlegroups.com) to participate in discussions with other members of the GoogleStackdriver community.
---
You received this message because you are subscribed to the Google Groups "Google Stackdriver Discussion Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-stackdriver-d...@googlegroups.com.
To post to this group, send email to google-stackdr...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-stackdriver-discussion/7a652665-ab29-42b7-af33-df912b731217%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[peter...@cjcit.com]

Hi Igor,

I created a new VM and managed to get this working, I had followed the instructions provided on your reply however I think I had already messed around with the server too much.

Thanks

Peter

On Wednesday, April 10, 2019 at 3:53:29 PM UTC+1, Igor Peshansky wrote:

Please follow the steps at https://cloud.google.com/logging/docs/agent/troubleshooting, especially those related to credentials, to ensure that your agent is authorized correctly. On GCE you'd normally use the VM's default service account via the application default credentials token, which would ensure that you're writing to the same project the VM is running in. From the error, it looks like you may have downloaded the end-user credentials (client_secrets.json) instead of the service account private key (application_default_credentials.json). Moreover, since the agent is extracting the project from the credentials file if one is present, it's possible that you're attempting to write the logs to the wrong project because the service account was not created in the same project that runs the VM (as outlined in the troubleshooting steps). But I would first try to run the agent with no extra credentials altogether (see the first note in the authorization guide).

Hope this helps. If you are still having trouble and need us to look at the specific details of your project, your best bet is to open a support case with Google Cloud Support.

        Igor

On Wed, Apr 10, 2019, 10:14 AM <peter...@cjcit.com> wrote:

Hi All,

I am setting up google-fluentd so I can forward my logs through the StackDriver solution through to a pub/sub that a server somewhere can read however, I am getting the below error.

2019-04-10 13:37:35 +0000 [warn]: #0 Dropping 2 log message(s) error="User unauthorized to access 764086051850" error_code="7"

I've given the VM and the Service Account permissions to Stackdriver Logging API and have ensured this API is enabled.

Have attached screenshots showing API enabled, and all the other permissions.

Any ideas how to resolve this issue? I've tried reinstalling the API.

I've also tried setting the $GOOGLE_AUTHENTICATION_CREDENTIALS with the service accounts JSON key but no luck.

One thing to note is the below log message from /var/log/messages, not sure why its saying this when using a service account.

Apr 10 13:37:04 test-1 google-fluentd: Starting google-fluentd 1.6.6: Your application has authenticated using end user credentials from Google Cloud SDK. We recommend that most server applications use service accounts instead. If your application continues to use end user credentials from Cloud SDK, you might receive a "quota exceeded" or "API not enabled" error. For more information about service accounts, see https://cloud.google.com/docs/authentication/.

Apr 10 13:37:04 test-1 google-fluentd: [  OK  ]#015google-fluentd[  OK  ]

Thanks!

Peter

--
© 2016 Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043
 

Email preferences: You received this email because you signed up for the Google Stackdriver Discussion Google Group (google-stackdriver-discu...@googlegroups.com) to participate in discussions with other members of the GoogleStackdriver community.

---
You received this message because you are subscribed to the Google Groups "Google Stackdriver Discussion Forum" group.

To unsubscribe from this group and stop receiving emails from it, send an email to google-stackdriver-discussion+unsub...@googlegroups.com.