topic Re: How to fix External search command 'ldapsearch' returned error code 15? in All Apps and Add-ons

How to fix External search command 'ldapsearch' returned error code 15?

rayar — Thu, 26 May 2022 16:36:28 GMT

I am running the ldapsearch in scheduled report which initially runs outputlookup and getting the below error message

the ldapsearch returns 250 results and working properly once I am running it manually

05-26-2022 04:08:16.147 +0300 ERROR SearchMessages - orig_component="script" app="amdocscybermain" sid="scheduler__odeliab__amdocscybermain__RMD59063549f9a2aae97_at_1653527160_38496" message_key="EXTERN:SCRIPT_NONZERO_RETURN"

message=External search command 'ldapsearch' returned error code 15. .

app = amdocscybermain
component = SearchMessages
date_zone = 180
eventtype = err0r error
host = illinissplnksh01
index = _internal
log_level = ERROR
message = External search command 'ldapsearch' returned error code 15. .
sid = scheduler__odeliab__amdocscybermain__RMD59063549f9a2aae97_at_1653527160_38496
source = /opt/splunk/var/log/splunk/search_messages.log
sourcetype = splunk_search_messages

Re: How to fix External search command 'ldapsearch' returned error code 15?

razdansu — Wed, 01 Jun 2022 13:12:31 GMT

“Error code 15: This request was blocked by the security rules”

Check if your server is allowed to get data from other machines from which you are fetching the data

Also check DATE and TIME settings

Re: How to fix External search command 'ldapsearch' returned error code 15?

razdansu — Thu, 02 Jun 2022 08:28:24 GMT

@rayar Kindly check firewall settings of both client machines and ADMIN/ AD server machine

check authentication as well as try to ping (run ping command from AD server to ensure a stable connection)

Re: How to fix External search command 'ldapsearch' returned error code 15?

rayar — Thu, 02 Jun 2022 08:43:14 GMT

the same query is running from same machine properly

we are getting this issue for scheduled report only , so I don't think its related to the Firewall

Re: How to fix External search command 'ldapsearch' returned error code 15?

razdansu — Thu, 02 Jun 2022 10:40:05 GMT

@rayar hey buddy

1. So u are getting events upon maunally searching the command

and for the same events u had created a report using (cron ) I guess every 5 minutes ?

2. which version of this add on,

as well as splunk are u on ?

3. have u recently upgraded anything (add on / splunk) had u created this report u are talking about in some previous version (add on / splunk)

ps I am intrested in ur case and want to help

Re: How to fix External search command 'ldapsearch' returned error code 15?

razdansu — Thu, 02 Jun 2022 11:20:19 GMT

@rayar

Re: How to fix External search command 'ldapsearch' returned error code 15?

rayar — Thu, 02 Jun 2022 12:00:07 GMT

The steps are correct

We have upgraded from Splunk 7.XX to Splunk 8.2.5 with PS

I think the issue started after few days

Splunk Supporting Add-on for Active Directory

SA-ldapsearch

3.0.1

Re: How to fix External search command 'ldapsearch' returned error code 15?

razdansu — Fri, 03 Jun 2022 11:24:23 GMT

@rayar

Check the configuration and try clicking on "Run" I received the report on email after I clicked the "Run " button I have scribbled Above

Also see screenshots , if u are missing something

CHECK your email ID too

A simple letter could be capitalized and your whole email would be considered wrong

Re: How to fix External search command 'ldapsearch' returned error code 15?

razdansu — Fri, 03 Jun 2022 11:28:27 GMT

@rayar anddddd if nothing works, just update the ADD-ON to its latest version 3.0.4

I used this version and got the scheduled report on email

and tell me if its fixed