How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

kiran331 — Thu, 30 Mar 2017 14:48:08 GMT

I Installed a Add-on on the Heavy Forwarder, when I try to setup the Add-On using API and credentials, its showing the error

"Fail to update configuration for add-on xxx" but the add-on is working on other heavy Forwarder -2. Both are running under splunk user. I tried to copy the installation file from one HF to other and i got the below error, if its a permissions issue how to resolve this one?

"Fail to load configuration for add-on xxx"

Re: How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

rpille_splunk — Thu, 30 Mar 2017 15:06:02 GMT

Why are you trying to configure the add-on on two different heavy forwarders? Are you planning to manually split input collection between two heavy forwarders without overlapping them?

Which add-on is this?

Re: How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

kiran331 — Thu, 30 Mar 2017 15:12:00 GMT

I need this on only one Heavy Forwarder, For Testing I installed it on other. Its working on other Heavy Forwarder. Its TA-CiscoAmp

Re: How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

rpille_splunk — Thu, 30 Mar 2017 15:17:17 GMT

Try configuring it without copying over the configurations from the first forwarder. Because this add-on involves credentials, copying over the files probably will not work.

Re: How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

kiran331 — Thu, 30 Mar 2017 15:23:09 GMT

Yes I tried installing the add-on directly on HF, it shows the above errors and then I tried the copy option.

Re: How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

rpille_splunk — Thu, 30 Mar 2017 16:50:46 GMT

I'm not familiar with that add-on, so this advice is generic. If you've tried manually configuring it on the new forwarder, then I'd suggest disabling the add-on on the first forwarder and trying again.

If that doesn't work, look for all of the ways in which the new forwarder is different from the one on which you installed the add-on for testing, or anything that might be different about the configuration on the new forwarder vs the old one. Perhaps your API key expired? Perhaps you've exceeded your rate limit with the number of API calls you already made? Perhaps your browser is caching different credentials when you configure your connection to the API?

Re: How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

kiran331 — Tue, 29 Sep 2020 13:29:45 GMT

Hi rpille,

I see the below error i n python.log ,when i setup the add-on.

2017-03-30 13:11:46,364 ERROR Run function: delete_password failed: Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 179, in delete_password
all_passwords = self._storage_passwords.list()
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1459, in list
return list(self.iter(count=count, **kwargs))
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1419, in iter
items = self._load_list(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1325, in _load_list
entries = _load_atom_entries(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 201, in _load_atom_entries
r = _load_atom(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 196, in _load_atom
return data.load(response.body.read(), match)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/data.py", line 77, in load
root = XML(text)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1300, in XML
parser.feed(text)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1642, in feed
self._raiseerror(v)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1506, in _raiseerror
raise err
ParseError: not well-formed (invalid token): line 33, column 37
.
2017-03-30 13:11:46,365 ERROR Run function: set_password failed: Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 138, in set_password
self.delete_password(user)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 179, in delete_password
all_passwords = self._storage_passwords.list()
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1459, in list
return list(self.iter(count=count, **kwargs))
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1419, in iter
items = self._load_list(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1325, in _load_list
entries = _load_atom_entries(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 201, in _load_atom_entries
r = _load_atom(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 196, in _load_atom
return data.load(response.body.read(), match)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/data.py", line 77, in load
root = XML(text)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1300, in XML
parser.feed(text)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1642, in feed
self._raiseerror(v)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1506, in _raiseerror
raise err
ParseError: not well-formed (invalid token): line 33, column 37
.
2017-03-30 13:11:46,366 ERROR Run function: update failed: Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/conf_manager.py", line 251, in update
encrypt_keys)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/conf_manager.py", line 110, in _encrypt_stanza
self._cred_mgr.set_password(stanza_name, json.dumps(encrypt_fields))
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 138, in set_password
self.delete_password(user)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 179, in delete_password
all_passwords = self._storage_passwords.list()
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1459, in list
return list(self.iter(count=count, **kwargs))
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1419, in iter
items = self._load_list(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1325, in _load_list
entries = _load_atom_entries(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 201, in _load_atom_entries
r = _load_atom(response)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 196, in _load_atom
return data.load(response.body.read(), match)
File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/data.py", line 77, in load
root = XML(text)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1300, in XML
parser.feed(text)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1642, in feed
self._raiseerror(v)
File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1506, in _raiseerror
raise err
ParseError: not well-formed (invalid token): line 33, column 37

topic Re: How to resolve the Fail to update configuration for add-on error on heavy Forwarder? in Getting Data In

How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

Re: How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

Re: How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

Re: How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

Re: How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

Re: How to resolve the Fail to update configuration for add-on error on heavy Forwarder?

Re: How to resolve the Fail to update configuration for add-on error on heavy Forwarder?