Auditbot troubleshooting

Auditbot Viewing Error - Bad MAC

This is a symptom that Auditbot Secure Storage got corrupted. It can happen if you try to change the passphrase of Auditbot through the UI for example.

This procedure will make rooms history unable to decrypt in auditbot UI. The rooms history will still be available in audit logs generated by auditbot, in the S3 or file storage.

To resolve you will need to reset the 4S passphrase of auditbot.

1. Stop the operator and edit the auditbot pipe:

   kubectl scale deploy/element-operator-controller-manager -n operator-onprem --replicas=0
   kubectl edit statefulsets.apps first-element-deployment-auditbot-pipe -n element-onprem
   

2. Add the following under env:

   - name: AUDIT_FORCE_NEW_SSSS
     value: "true"
   

Wait for the pipe to restart, check its logs, and check that you can log in through the Admin Console.

3. Edit the Statefulset again:

   kubectl edit statefulsets.apps first-element-deployment-auditbot-pipe -n element-onprem
   

4. Remove the env variable you added:

   - name: AUDIT_FORCE_NEW_SSSS
     value: "true"
   

5. Restart the operator :

   kubectl scale deploy/element-operator-controller-manager -n operator-onprem --replicas=1
   

This will restart auditbot and it normal functionality should be restored.