topic Re: TA-DMARC scheme error in All Apps and Add-ons

TA-DMARC scheme error

amyers16 — Fri, 23 Oct 2020 14:27:00 GMT

I'm using Splunk 8.1.0 on CentOS 7 and TA-dmarc 3.2.1. When the app loads, I get the following error:

Unable to initialize modular input "dmarc_pop3" defined in the app "TA-dmarc": Introspecting scheme=dmarc_pop3: script running failed (exited with code 1)

Not sure what to make of it or how to even start troubleshooting.

Thanks,
Aaron

Re: TA-DMARC scheme error

alemarzu — Sat, 24 Oct 2020 00:44:55 GMT

Hi @amyers16

There must be a python version compatibility issue, read the docs from the app and make sure is compatible with your Splunk version. Also, if you are running Splunk v8.x, check which python version is enabled on your $SPLUNK_HOME/etc/system/local/server.conf under the [general] stanza.

Like this

[general]
serverName = hostname
python.version = python3

Re: TA-DMARC scheme error

amyers16 — Mon, 26 Oct 2020 16:06:13 GMT

Hi @alemarzu and thanks for the reply. I am on 8.1.0 and checked the [general] stanza. Python version wasn't defined so I added it and restarted. Unfortunately still the same issue. I reached out to the dev via email and they said they'd look into it.

Re: TA-DMARC scheme error

wstarowicz — Tue, 02 Feb 2021 07:54:30 GMT

Have the same problem on Splunk 8.1.1. For now (because it is still possible) I forced globally on host downloading these data to use python2 and it works. So it seems as some incompatibility with python 3?

@jorritfany ideas on that? Below errors received:

25/01/2021 14:34:27.069 01-25-2021 14:34:27.069 +0100 ERROR ModularInputs - Unable to initialize modular input "dmarc_imap" defined in the app "TA-dmarc": Introspecting scheme=dmarc_imap: script running failed (exited with code 1).. 25/01/2021 14:34:27.069 01-25-2021 14:34:27.069 +0100 ERROR ModularInputs - Introspecting scheme=dmarc_imap: script running failed (exited with code 1). 25/01/2021 14:34:27.069 01-25-2021 14:34:27.069 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap: ImportError: This package should not be accessible on Python 3. Either you are trying to run from the python-future src folder or your installation of python-future is corrupted. 25/01/2021 14:34:27.069 01-25-2021 14:34:27.069 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap: raise ImportError('This package should not be accessible on Python 3. ' 25/01/2021 14:34:27.069 01-25-2021 14:34:27.069 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap: File "/opt/splunk/etc/apps/TA-dmarc/bin/copyreg/__init__.py", line 7, in <module> 25/01/2021 14:34:27.068 01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap: import copyreg 25/01/2021 14:34:27.068 01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap: File "/opt/splunk/lib/python3.7/re.py", line 321, in <module> 25/01/2021 14:34:27.068 01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap: import re 25/01/2021 14:34:27.068 01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap: File "/opt/splunk/etc/apps/TA-dmarc/bin/ta_dmarc_declare.py", line 10, in <module> 25/01/2021 14:34:27.068 01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap: import ta_dmarc_declare 25/01/2021 14:34:27.068 01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap: File "/opt/splunk/etc/apps/TA-dmarc/bin/dmarc_imap.py", line 1, in <module> 25/01/2021 14:34:27.068 01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap: Traceback (most recent call last):

Re: TA-DMARC scheme error

jorritf — Mon, 08 Mar 2021 09:01:11 GMT

Just a quick note for other who might land here via Google: this issue was fixed in 3.2.3.

From the changelog (nov. 26, 2020):

Added support for Splunk 8.1. (Thanks to Aaron Myers for reporting the issue)
Fixed exception when using add-on together with listenOnIPv6=yes (Thanks to gryphius for reporting this issue)
Fixed Gmail POP3 issue

Re: TA-DMARC scheme error

wstarowicz — Tue, 09 Mar 2021 09:32:03 GMT

Hi @jorritf

I have it working on Splunk 8.1, but fails when setting Python 3 as default (please see logs below). After switching to Python 2 it works fine.

Re: TA-DMARC scheme error

jorritf — Thu, 15 Apr 2021 07:00:35 GMT

If there are still issues like these on 3.2.4, I suggest to:

clear out the TA-dmarc/local/ directory (which resets the config back to default)
if that doesn't work: remove the entire add-on from the heavy forwarder and reinstall

This seems to solve a number of reports where there were still Python2/3 related issues resulting in TA-dmarc: Introspecting scheme=<something> : script running failed (exited with code 1).

I haven't been able to reproduce any of these weird errors. A clean install on any Splunk version Just Works. I also tested some upgrade scenarios but haven't been able to find any issues there either. So I can't offer any direct solution, except for the "delete and reinstall" workaround above.