Skip to main content
Panther Knowledge Base

How to solve "Source experienced errors recently while trying to access S3 objects" for Panther Log Source

Issue

A Log Source has failed with the ambiguous error message "Source experienced errors recently while trying to access S3 objects".

Resolution

You may need to open a support case to determine the cause of the error. To start the troubleshooting process, please do the following:

  1. In the Panther Console, navigate to Configure > Log Sources.
    • You will see a list of all Log Sources in your Panther instance. Find the Source that is triggering the error. (Pro-Tip: You can use the "Filter" button to only display unhealthy Log Sources, which might make it easier to find.)
  2. Click on the log source that is producing the error.
  3. On the left side of the log source page, look under Basic Info and find the Log Source ID. Copy this value.
  4. Navigate to the Data Explorer.
    1. In the Data Explorer, enter the following SQL query:​​​
      select * from panther_monitor.public.data_audit
      where p_occurs_since('30 days') and
      status != 'SUCCESS' and
      p_source_id = 'YOUR_LOG_SOURCE_ID'
      order by p_event_time desc
      limit 100;


      Replace 'YOUR_SOURCE_ID' with the Source ID you found in step 2. Also, adjust the time window in p_occurs_since as needed.
  5. Export the query results. Note the following:
    • You can export the query results to a CSV file by clicking the "Download CSV" button above the results panel in the Data Explorer.
  6. Contact Panther Support and include the exported query results. In your ticket to Support, include:
    • Which type of Log Source is having issues, and if it's a custom Log Integration or one of the Panther-provided ones.
    • The CSV export from the SQL query.
    • All errors you see on this Log Source, including "Source experienced errors recently while trying to access S3 objects".
    • If this is a new Log Source, or an existing one that previously worked fine.

Following these steps, a Support Engineer will be able to more rapidly diagnose the problem and restore functionality to your Log Source.

Cause

This error indicates a catch-all for any errors reading files from an S3 bucket, including, but not limited to:

  • A mis-configured stream-type
  • Errors in the log file formatting

 

 

 

 

  • Was this article helpful?