topic Re: Splunk Add-on for Tenable (seemingly) randomly stops pulling data. in All Apps and Add-ons

Splunk Add-on for Tenable (seemingly) randomly stops pulling data.

chrishartsock — Tue, 29 Sep 2020 15:42:55 GMT

I am running Splunk Add-on for Tenable 5.1.1 on a heavy forwarder that is running Splunk 6.6.3 to pull vulnerability data from Tenable Security Center. I am having an issue where the add-on stops pulling. This usually happens around once a day. The odd the is I am not getting any errors or even warnings in the logs. It will be working perfectly and then just stops pulling. When it stops I can go in, disable the input, change the checkpoint value to the timestamp of the last event pulled in, then re-enable the input and it will start pulling in again without issue.

I can see in the logs that it is actually still attempting to do something even though it isn't pulling anything. The following is getting logged every 2 minutes (which is the schedule it runs on):

2017-09-11 20:06:57,601 +0000 log_level=INFO, pid=13810, tid=Thread-2, file=scheduler.py, func_name=get_ready_jobs, code_line_no=100 | Get 1 ready jobs, next duration is 119.999509, and there are 1 jobs scheduling
2017-09-11 20:06:57,601 +0000 log_level=INFO, pid=13810, tid=Thread-6, file=thread_pool.py, func_name=_run, code_line_no=261 | Thread work_queue_size=0

Any ideas would be greatly appreciated.

Note: I have been dealing with this for quite a while. Even when the HF was on Splunk 6.5.x.

Re: Splunk Add-on for Tenable (seemingly) randomly stops pulling data.

benlc — Tue, 05 Dec 2017 08:24:25 GMT

It seems we have a very similiar problem. Also a restart of the HF does solve the problem here.
Thanks for any help.

Re: Splunk Add-on for Tenable (seemingly) randomly stops pulling data.

Yunagi — Thu, 14 Dec 2017 10:57:52 GMT

The latest version of the Splunk Add-on for Tenable is 5.1.2. It was released in October 2017.

The Fixed Issues section for 5.1.2 says:

Version 5.1.2 of the Splunk Add-on for Tenable fixes the following issues.

2017-08-22  ADDON-13413     Tenable input stops pulling vulnerability data

Have you tested 5.1.2?

Re: Splunk Add-on for Tenable (seemingly) randomly stops pulling data.

kamal_jagga — Tue, 20 Feb 2018 22:27:27 GMT

Has anyone tested this ?

Re: Splunk Add-on for Tenable (seemingly) randomly stops pulling data.

chrishartsock — Thu, 22 Mar 2018 11:20:38 GMT

We are now on 5.1.2 and still experiencing the same issue.

Re: Splunk Add-on for Tenable (seemingly) randomly stops pulling data.

ccsfdave — Thu, 03 May 2018 17:59:17 GMT

I was having this issue with 5.1.1, upgraded last week to 5.1..3. Worked for a while, now it is broken again!

Re: Splunk Add-on for Tenable (seemingly) randomly stops pulling data.

kcooper — Thu, 23 May 2019 11:52:01 GMT

The same issue just started with our tenable add-on.
we were receiving data and now it stopped
I restarted the Splunk service on the DCN but still doesn't work
Anyone have any additional recommendations?