topic Re: Problem: scripted inputs stop running in certain time ? in Getting Data In

Problem: scripted inputs stop running in certain time ?

sieutruc — Tue, 25 Sep 2012 09:41:34 GMT

Hello,

I have several scripted input written in python. At the beginning, it run well but after about 10 minutes, it stopped running, and in the splunkd.log i just see an error as below:

09-25-2012 10:54:09.821 +0200 INFO  ExecProcessor - Ran script: "C:\Program Files\Splunk\etc\apps\Splunk_TA_windows\bin\memory.bat", took -3304.2 seconds to run, 617 bytes read
09-25-2012 10:54:47.977 +0200 WARN  DispatchCommand - Modtime 'Tue Sep 25 11:44:45 2012' for 'C:\Program Files\Splunk\var\run\splunk\dispatch\1348566284.10\status.csv' is 2998.0 seconds in the future; please check for clock skew
09-25-2012 11:58:56.175 +0200 INFO  WinEventLogChannel - getEvents: Unable to read Windows Event Logs 'System'; rec_id='0'; t_bytes_read='0'; bytes_needed='0'; buf_size='131071'; err_msg(38)='Reached the end of the file.';
09-25-2012 12:00:18.177 +0200 INFO  WinEventLogChannel - getEvents: Unable to read Windows Event Logs 'System'; rec_id='0'; t_bytes_read='0'; bytes_needed='0'; buf_size='131071'; err_msg(38)='Reached the end of the file.';

I don't know why it likes that. It's strange that the error is not concerning about scripted input file . Any suggestion for solving that problem ?

Re: Problem: scripted inputs stop running in certain time ?

Drainy — Tue, 25 Sep 2012 11:13:31 GMT

I would suggest that nothing above relates to your script or is in fact a problem.

Do a search for index=_internal error *py* to see if you can locate any actual error.
How does your script terminate?
Also, do you have any logging inside your script? If not, I would suggest importing logging and generate your own logs to gain visibility to what your script is up to.

P.S. The bits above are just talking about a batch file executing, monitor reaching the end of some event logs, a time issue on a CSV file..

Re: Problem: scripted inputs stop running in certain time ?

MHibbin — Tue, 25 Sep 2012 11:38:05 GMT

To add some references to this...

The following is the official docs on logging:
http://docs.python.org/howto/logging.html

And this has various solutions in a cookbook format:
http://docs.python.org/howto/logging-cookbook.html

Re: Problem: scripted inputs stop running in certain time ?

sieutruc — Tue, 25 Sep 2012 12:47:22 GMT

Thanks for your suggestion for logging. In fact, my problem is about time difference between the indexer and the machine that i used to view Splunk web. After i made a time balance between both of them, it seems to run well and the scipted input doesn't still get stuck.
But i think Splunk should fairly deal with this issue in case of viewing web remotely.