topic Re: File Integrity Check Error in Heavy Forwarder Server in Splunk Enterprise

File Integrity Check Error in Heavy Forwarder Server

anandhalagaras1 — Wed, 16 Aug 2023 16:37:00 GMT

In my Heavy Forwarder server I am seeing this message as below recently in the messages tab.

File Integrity checks found 114 files that did not match the system-provided manifest. Review the list of problems reported by the InstalledFileHashChecker in splunkd.log File Integrity Check View ; potentially restore files from installation media, change practices to avoid changing files, or work with support to identify the problem. Learn more.

So how can we get it fixed.

Re: File Integrity Check Error in Heavy Forwarder Server

richgalloway — Wed, 16 Aug 2023 19:51:09 GMT

The message pretty much says what you need to do.

Login to the HF and open the Search & Reporting app. Click on the Dashboards tab then select "Integrity Check of Installed Files". That dashboard will list the files that failed integrity checks.

To fix them:

1) Undo any changes made to the files or restore them from the download file that installed them.

2) NEVER change a file in a 'default' directory.

Re: File Integrity Check Error in Heavy Forwarder Server

anandhalagaras1 — Thu, 17 Aug 2023 07:04:15 GMT

@richgalloway

Thanks for your response.

Recently we have upgraded the app "Upgrade Readiness App" to the latest version 4.1.1 in the HF server post which i am getting the error message in Splunk.

As you have mentioned I have navigated to the Dashboard section and then I have clicked the "Integrity Check of Installed Files" dashboard and here I can see the file path and results and for all of them it seems to be triggered from Upgrade Readiness App only. Refer below:

So how can we get it fixed.

File path Check result
/opt/splunk/etc/apps/python_upgrade_readiness_app/appserver/static/pages/jquery_scan.js differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/appserver/static/pages/python_scan.js differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/appserver/static/pages/setting.js differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/appserver/static/pages/setting_scan.js differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/appserver/static/pages/splunk9x_scan.js differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/bin/eura_app_list.py differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/bin/eura_check_mongodb_tls_dns_validation.py differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/bin/eura_check_python_tls.py differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/bin/eura_check_search_peer_ssl_config.py differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/bin/eura_email_notification_switch_scripted_input.py differs

Re: File Integrity Check Error in Heavy Forwarder Server

richgalloway — Thu, 17 Aug 2023 12:06:08 GMT

The Upgrade Readiness App ships with Splunk and so should not be upgraded separately. That Splunk allows it to be upgraded is a mistake, IMO.

You can try downgrading the app or just live with the file integrity warnings.

Re: File Integrity Check Error in Heavy Forwarder Server

anandhalagaras1 — Thu, 17 Aug 2023 12:11:48 GMT

@richgalloway ,

Thank you for the information.

So is this app really required to be present in HF and DM server and if its not really needed then can we uninstall the app?

Or can we disable the app in our HF and DM server.

Which can be a recommended solution here. Please suggest.

Re: File Integrity Check Error in Heavy Forwarder Server

richgalloway — Thu, 17 Aug 2023 12:24:08 GMT

It's best to not touch any app that ships with Splunk.

The HF and DS do not need the app, although it can be used on an HF. Do not uninstall it. It is safe to disable it.

Re: File Integrity Check Error in Heavy Forwarder Server

anandhalagaras1 — Thu, 17 Aug 2023 12:38:59 GMT

@richgalloway

Thank you for your valuable inputs.

Much appreciated.

As of now I will disable them in HF and DM servers.