Commits call returns a http 409

[adrianblakey]

Please could you tell me why we are seeing this error?

2019-01-16 14:24:24,007 ERROR pid=20699 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-Github/bin/ta_github/modinput_wrapper/base_modinput.py", line 127, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-Github/bin/github_api_repos_commits.py", line 72, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-Github/bin/input_module_github_api_repos_commits.py", line 135, in collect_events raise error HTTPError: 409 Client Error: Conflict for url: https://git.xxx.xxx/api/v3/repos/Foo/repo/commits?since=2018-01-25&per_page=50

2019-01-16 14:24:15,844 ERROR pid=19785 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-Github/bin/ta_github/modinput_wrapper/base_modinput.py", line 127, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-Github/bin/github_api_repos_commits.py", line 72, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-Github/bin/input_module_github_api_repos_commits.py", line 135, in collect_events raise error HTTPError: 409 Client Error: Conflict for url: https://git.xxx.xxx/api/v3/repos/BAR/prj/commits?per_page=50&since=2018-01-25

[pentestfail]

Just from what is in the above messages, its hard to say beyond what is documented in GitHub's API documentation:

Git Database API functions will return a 409 Conflict if the Git repository is empty or unavailable. An unavailable repository typically means GitHub is in the process of creating the repository. For an empty repository, you can use the Create a file endpoint to create content and initialize the repository so you can use the Git Database API. Contact GitHub Support if this response status persists.

[adrianblakey]

Please could you add some code to simply retry the call if 409 is returned? https://httpstatuses.com/409

[pentestfail]

The input will run again at the next scheduled interval but from what I've observed in quick attempts to replicate the error this response could be returned if the account or "personal access token" does not have the appropriate permissions to the organization or repository. In that case, polling again would have no impact on the result. I believe the input does attempt to retry if the connection fails (timeout) to respond up to 3 times, but a 409 response will not.

Is the behavior you're experiencing that the response is only occurring randomly or every time? Furthermore, is the input returning data at all? Just confirming behavior as it's difficult to reproduce beyond the scenario described in the documentation.