用403写入Azure的Log Analytics Data Collector API返回。昨天工作良好

Question

The following code uses com.google.code.gson.gson:2.8.5 and org.asynchttpclient.async-http-client:2.5.2 to send JSONs to Azure's Log Analytics. It worked fine until yesterday midnight, but then suddenly started returning HTTP 403 responses. What went wrong?

public class LogAnalyticsSender {

    private static final Charset    UTF8            = Charset.forName("UTF-8");
    private static final String     HMAC_SHA256_ALG = "HmacSHA256";

    static String createAuthorization(String workspaceId, String key, int contentLength, String rfc1123Date) {
        try {
            // Documentation: https://docs.microsoft.com/en-us/rest/api/loganalytics/create-request
            String signature = String.format("POST\n%d\napplication/json\nx-ms-date:%s\n/api/logs", contentLength, rfc1123Date);
            Mac mac = Mac.getInstance(HMAC_SHA256_ALG);
            mac.init(new SecretKeySpec(DatatypeConverter.parseBase64Binary(key), HMAC_SHA256_ALG));
            String hmac = DatatypeConverter.printBase64Binary(mac.doFinal(signature.getBytes(UTF8)));
            return String.format("SharedKey %s:%s", workspaceId, hmac);
        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
            throw new RuntimeException(e);
        }
    }

    final SslEngineFactory          defaultSslEngineFactory = (configuration, peerHost, peerPort) -> {
                                                                try {
                                                                    SSLContext sslCtx = SSLContext.getDefault();
                                                                    SSLEngine sslEngine = sslCtx.createSSLEngine(peerHost, peerPort);
                                                                    sslEngine.setUseClientMode(true);
                                                                    return sslEngine;
                                                                } catch (NoSuchAlgorithmException e) {
                                                                    throw new RuntimeException(e);
                                                                }
                                                            };
    final String                    key;
    final String                    workspace;
    final Gson                      gson;
    final DefaultAsyncHttpClient    httpClient;

    public LogAnalyticsSender(String workspaceId, String base64Key, int maxConnections) {
        DefaultAsyncHttpClientConfig config = new DefaultAsyncHttpClientConfig.Builder().setMaxConnections(maxConnections)
                .setThreadPoolName("LogAnalyticsSender").setSslEngineFactory(this.defaultSslEngineFactory).build();
        this.key = base64Key;
        this.workspace = workspaceId;
        this.gson = new GsonBuilder().create();
        this.httpClient = new DefaultAsyncHttpClient(config);
    }

    public CompletableFuture<Response> sendPojo(Object o, String logType) {
        String json = this.gson.toJson(o);
        return sendRawJson(json, logType);
    }

    public CompletableFuture<Response> sendPojo(JsonElement element, String logType) {
        String json = this.gson.toJson(element);
        return sendRawJson(json, logType);
    }

    public CompletableFuture<Response> sendRawJson(String rawJson, String logType) {
        int bodyLength = rawJson.getBytes(UTF8).length;
        String nowRfc1123 = DateTimeFormatter.RFC_1123_DATE_TIME.format(ZonedDateTime.now(ZoneOffset.UTC));
        String createAuthorization = createAuthorization(this.workspace, this.key, bodyLength, nowRfc1123);
        return this.httpClient.preparePost("https://" + this.workspace + ".ods.opinsights.azure.com/api/logs?api-version=2016-04-01").setBody(rawJson)
                .addHeader("Authorization", createAuthorization).addHeader("Content-Type", "application/json").addHeader("Log-Type", logType)
                .addHeader("x-ms-date", nowRfc1123).execute().toCompletableFuture();
    }

    public void shutdown() {
        this.httpClient.close();
    }
}

Answer 1

(answering my own question)

The issue occurred when the date switched from Jul 31 to Aug 1. It turns out that Java's DateTimeFormatter.RFC_1123_DATE_TIME writes the day-of-month as a single digit, and the Log Analytics API doesn't like that.

The solution was to replace the regular RFC 1123 DateTimeFormatter with a pattern that uses two digits:

DateTimeFormatter.ofPattern("EEE, dd MMM yyyy HH:mm:ss O")