topic Re: Debugging TA_nix not reporting in All Apps and Add-ons

Debugging TA_nix not reporting

bwhite — Sat, 30 Sep 2023 23:25:05 GMT

I edited the conf files on my local server before deploying, so I know they are all identical.

I have 5 servers.

I copied the Splunk_TA_nix folder to apps.

3 of the 5 have data showing up for the new "os" index.

splunkd.log, in fact the whole splunk/log folder, didn't have any errors.

But it also didn't have any mention of "idx=os" on the missing servers.

I ran some of the scripts in Splunk_TA_nix/bin in debug mode. No errors.

What log file or index do I check to debug the issue?

Re: Debugging TA_nix not reporting

gcusello — Sun, 01 Oct 2023 08:22:47 GMT

Hi @bwhite,

Some checks:

have you other logs (e.g. internal or application) from the missing servers?
did you check that the TA_nix was correctly deployed to thos servers?
did you check that in thos servers the user runnig Splunk has the grants to read files and execute scripts?

Ciao.

Giuseppe

Re: Debugging TA_nix not reporting

thahir — Sun, 01 Oct 2023 11:09:20 GMT

@bwhite have you check the internal logs for the remaining 2 server which is not reporting to splunk

Re: Debugging TA_nix not reporting

bwhite — Mon, 16 Oct 2023 04:01:08 GMT

Thanks for the reply.

I did finally get back to this issue.
I checked and noticed that the execute permissions were missing from the scripts as you mentioned.

rw-rw-rw-

Adding those permissions helped but something else was still missing that I never found.

I finally solved it by downloading it directly to the server and expanding it there instead of downloading it and unzipping it on my machine first.

Everything magically started working.

Hope that helps,
Brad.

Re: Debugging TA_nix not reporting

gcusello — Mon, 16 Oct 2023 06:06:20 GMT

Hi @bwhite ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Debugging TA_nix not reporting

PickleRick — Mon, 16 Oct 2023 07:59:46 GMT

I suppose you unpacked and re-packed the TA on a windows box. That's typical for windows to mess up with unix permissions so it's not a good idea to - for example - run windows-based deployment server for unix clients.

Anyway, instead of editing files within the app (I hope you edited the local/ files, not the default/ ones) you can create an app with configs overwriting settings from the app. This way it might be more manageable.