topic Re: Getting error messages after Splunk Enterprise Security upgrade from 4.5.2 to 4.7.1 in Installation

Getting error messages after Splunk Enterprise Security upgrade from 4.5.2 to 4.7.1.

vin02 — Tue, 29 Sep 2020 15:29:43 GMT

Hi,

We have upgraded Enterprise Security from 4.5.2. to 4.7.1. After the upgrade we are getting two types of error message in our environment.
Type 1:

msg="A script exited abnormally" input="/opt/splunk/etc/apps/SA-Utils/bin/configuration_check.py" stanza="configuration_check://confcheck_es_app_version" status="exited with code 3"

Type 2:

A threat intelligence download has failed. stanza="iblocklist_spyware" host="xxxxx" status="threat list download failed after multiple retries"
A threat intelligence download has failed. stanza="iblocklist_proxy" host="xxxxx" status="threat list download failed after multiple retries"
A threat intelligence download has failed. stanza="iblocklist_tor" host="xxxxx" status="threat list download failed after multiple retries"
A threat intelligence download has failed. stanza="iblocklist_piratebay" host="xxxxx" status="threat list download failed after multiple retries"
A threat intelligence download has failed. stanza="iblocklist_web_attacker" host="xxxxx" status="threat list download failed after multiple retries"
A threat intelligence download has failed. stanza="iblocklist_rapidshare" host="xxxxx" status="threat list download failed after multiple retries"
A threat intelligence download has failed. stanza="iblocklist_logmein" host="xxxxx" status="threat list download failed after multiple retries"

Could you please suggest on this?

Re: Getting error messages after Splunk Enterprise Security upgrade from 4.5.2 to 4.7.1

gf13579 — Wed, 20 Sep 2017 05:34:50 GMT

I'm seeing 3 of the iblocklist* ones too, along with malware_domains. Our ES is running on Splunk Cloud

Re: Getting error messages after Splunk Enterprise Security upgrade from 4.5.2 to 4.7.1

mosman_splunk — Thu, 05 Oct 2017 03:23:32 GMT

make sure that the directory still owned by the correct user

Re: Getting error messages after Splunk Enterprise Security upgrade from 4.5.2 to 4.7.1

vin02 — Thu, 05 Oct 2017 03:29:43 GMT

yes directory owned by correct user.

Re: Getting error messages after Splunk Enterprise Security upgrade from 4.5.2 to 4.7.1

hcannon — Tue, 29 Sep 2020 16:52:15 GMT

We had this same issue after upgrade to 4.7.0 - Splunk Support advised it was a bug in this version and provided the following fix, which worked for us -

Edit splunk/etc/apps/DA-ESS-ThreatIntelligence/bin/configuration_checks/confcheck_failed_threat_download.py as below:

--- confcheck_failed_threat_download.old.py 
+++ confcheck_failed_threat_download.py 
@@ -33,7 +33,7 @@ 

messages = [] 

- job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest=earliest) 
+ job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest_time=earliest) 
while elapsed < srch_timeout: 
if job.isDone: 
if job.resultCount > 0 or job.eventCount > 0: