topic Re: Certificate Transparency Errors in All Apps and Add-ons

Certificate Transparency Errors

liquidclay23 — Wed, 30 Sep 2020 00:14:12 GMT

Hello All,

I have completed two separate installs of this app on different servers and then upgraded from Splunk 6 to 7. Both times I am getting the expected CT logs but I am also seeing a lot of internal errors. I see the exact same errors on both servers:

Are other people also seeing this, is this keeping me from collecting all the data I should be seeing? Thanks,

message from "python ../TA-ct-log/bin/ct_log.py" input_module.collect_events(self, ew)
message from "python ../TA-ct-log/bin/ct_log.py" obj, end = self.raw_decode(s, idx=w(s, 0).end())
message from "python ../TA-ct-log/bin/ct_log.py" obj.process_log()
message from "python ../TA-ct-log/bin/ct_log.py" raise ValueError("No JSON object could be decoded")
message from "python ../TA-ct-log/bin/ct_log.py" return _default_decoder.decode(s)
message from "python ../TA-ct-log/bin/ct_log.py" self.collect_events(ew)
message from "python ../TA-ct-log/bin/ct_log.py" sth = json.loads(r.text)
message from "python ../TA-ct-log/bin/ct_log.py" tree_size = self.get_tree_size()
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py", line 64, in collect_events
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ctl/ctl2splunk.py", line 169, in get_tree_size
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ctl/ctl2splunk.py", line 201, in process_log
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/input_module_ct_log.py", line 26, in collect_events
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ta_ct_log/modinput_wrapper/base_modinput.py", line 127, in stream_events
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/lib/python2.7/json/init_.py", line 339, in loads
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/lib/python2.7/json/decoder.py", line 364, in decode
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/lib/python2.7/json/decoder.py", line 382, in raw_decode
message from "python ../TA-ct-log/bin/ct_log.py" ERRORNo JSON object could be decoded
message from "python ../TA-ct-log/bin/ct_log.py" Traceback (most recent call last):
message from "python ../TA-ct-log/bin/ct_log.py" ValueError: No JSON object could be decoded

I am just showing the message field to fit on the screen. All evens are coming in as component=ExecProcessor and log_level=ERROR

Re: Certificate Transparency Errors

jorritf — Sun, 28 Apr 2019 14:44:42 GMT

Can you try if version 1.3.0 (on Github only) fixes this for you?
If so, I'll publish it on Splunkbase

Re: Certificate Transparency Errors

liquidclay23 — Wed, 30 Sep 2020 00:18:28 GMT

Thank you for your response jorritf. I uploaded the version of the app in GIT and immediately saw a significant improvement. Prior I was seeing about 684 errors a day. I am only seeing 18 errors since I upgraded yesterday.

component log_level event_message count
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" Traceback (most recent call last): 2
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" input_module.collect_events(self, ew) 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" obj.process_log() 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" os.rename(sfn, dfn) 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" raise Exception("Error saving checkpoint data with with exception %s" % str(e)) 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" self.collect_events(ew) 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" self.doRollover() 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py", line 64, in collect_events 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ctl/ctl2splunk.py", line 254, in process_log 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/input_module_ct_log.py", line 23, in collect_events 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ta_ct_log/modinput_wrapper/base_modinput.py", line 127, in stream_events 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" File "/opt/splunk/lib/python2.7/logging/handlers.py", line 136, in doRollover 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" File "/opt/splunk/lib/python2.7/logging/handlers.py", line 77, in emit 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" ERRORError saving checkpoint data with with exception ('Connection aborted.', BadStatusLine("''",)) 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" Exception: Error saving checkpoint data with with exception ('Connection aborted.', BadStatusLine("''",)) 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" Logged from file base_modinput.py, line 293 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" OSError: [Errno 2] No such file or directory