Bad rows: Tracker protocol

For engineers
1

Hi,

I’m seeing these regularly. Any idea, where this could come from?

    {"schema":"iglu:com.snowplowanalytics.snowplow.badrows/tracker_protocol_violations/jsonschema/1-0-0","data":{"processor":{"artifact":"beam-enrich","version":"1.2.3"},"failure":{"timestamp":"2020-07-08T15:18:40.525Z","vendor":"com.snowplowanalytics.snowplow","version":"tp2","messages":[{"field":"contentType","value":"application/octet-stream","expectation":"expected one of application/json, application/json; charset=utf-8, application/json; charset=UTF-8"}]}

This happens on random pages on our website it seems…

2

That error suggests you’re sending events to the /tp2 endpoint with the Content-Type header of application/octet-stream.

Are you sending events directly to the collector endpoints, if not, what Trackers are you using?

3

I’m only using the JS tracker set up via GTM. No events are directly sent to the endpoint. It also seems to happen really randomly. Like one in 5000 Events on a specific page or so…

4

Interesting. I’m not sure I’d be too worried about it.

Given your description, perhaps this is a bot or some sort of monitoring of the endpoints health?

5

It’s definitely data that comes from the Javascript tracker. It contains custom contexts as well…

Looks like a Facebook app browser user agent for most of these hits:

Mozilla/5.0 (Linux; Android 5.1; X12 Build/LMY47D) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/39.0.0.0 Mobile Safari/537.36 [FB_IAB/FB4A;FBAV/278.0.0.51.119;]

6

Thats quite an interesting UA. That’s the most recent version of the Facebook app on Android but a very old version of Android (Lollipop 5.1). I know there has been a big update to the Facebook application on Android recently, so I’m wondering if something odd has been introduced there.

Are you seeing this exact UA or are you seeing variations on this UA (different Android versions, etc?).

I’ll see if I can reproduce this using my devices, although it seems unlikely that I’ll be able to do anything in the JavaScript tracker as we explictly set the header to application/json; charset=UTF-8 on POST and Beacon requests. I assume you’re using POST or Beacon as your event method?

7

Yes, I’m using the Beacon method. This user agent popped up quite often with different android versions, but now I also found completely different ones like these:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Safari/605.1.15
Mozilla/5.0 (iPad; CPU OS 12_4_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1

These are definitely users, some even logged in. Could this be some weird web server configuration issue on our side?

8

I certainly could be. It seems like something is playing with the request headers.

Could you perhaps elaborate on your load balancer, collector set up and configuration a little?

9

Hi Paul,

sorry for the late reply. I believe I’ve found the problem. The schema files in GCS were marked as “application/octet-stream” automatically on upload. I changed them to “application/json” now:

image

1 Like