topic Re: Why i am getting error : msg="A script exited abnormally" input="./bin/instrumentation.py" in Installation

Error after upgrading to version 7.1.1.

MAMAOUI — Thu, 11 Jun 2020 23:46:47 GMT

Hi All,

Every minute I receive the error:

msg="A script exited abnormally" input="./bin/instrumentation.py" stanza="default" status="exited with code 114"

I get this error after upgrading to Splunk 7.1.1.

Thanks
M&A

Re: Why i am getting error : msg="A script exited abnormally" input="./bin/instrumentation.py"

renjith_nair — Wed, 20 Jun 2018 12:47:52 GMT

Hi @MAMAOUI,

Check your inputs.conf where you have a script scheduled /bin/instrumentation.py and try to identify the issue with the script.

Re: Why i am getting error : msg="A script exited abnormally" input="./bin/instrumentation.py"

stmyers84 — Wed, 27 Jun 2018 12:54:31 GMT

I'm also getting this error, and have disabled the scripted input in inputs.conf....still getting error.

Re: Why i am getting error : msg="A script exited abnormally" input="./bin/instrumentation.py"

MAMAOUI — Wed, 11 Jul 2018 07:14:06 GMT

I have the same probleme,I verified the input.conf ... and still getting same message error, did you find any solution?Thanks

Re: Why i am getting error : msg="A script exited abnormally" input="./bin/instrumentation.py"

jamesjarrett — Wed, 18 Jul 2018 16:17:41 GMT

I too am having this issue with my SplunkES instance. Of course, it is highly underpowered but still suffering this issue after upgrading to 7.1.1

Other instances are not having this issue. All are Azure VMs

Re: Why i am getting error : msg="A script exited abnormally" input="./bin/instrumentation.py"

donaldmurchison — Tue, 29 Sep 2020 20:44:42 GMT

I recently had this issue on an instance with ES as well. We traced it back to the “[configuration_check://confcheck_script_errors]” stanza in inputs.conf of the ES app. It looks like this stanza was not in ES version 5.0.1.

We decided to just add instrumentation.py to the regex in the suppress setting of this stanza. The error is still included in the internal logs but doesn’t show up as a bulletin message anymore.

Re: Why i am getting error : msg="A script exited abnormally" input="./bin/instrumentation.py"

MAMAOUI — Tue, 29 Sep 2020 20:53:38 GMT

Hello,
Thanks Donald, I added instrumentation script in the suppress stanza “[configuration_check://confcheck_script_errors]” in local and it worked , i don't see message error anymore.

Re: Why i am getting error : msg="A script exited abnormally" input="./bin/instrumentation.py"

jamesjarrett — Mon, 13 Aug 2018 15:15:53 GMT

While it may get rid of the problem showing up in the the messages, it still doesn't address whatever this issue is. I would have figured that someone would have a much better answer by now - especially since its related to Enterprise Security :-(.

Re: Why i am getting error : msg="A script exited abnormally" input="./bin/instrumentation.py"

donaldmurchison — Tue, 29 Sep 2020 20:54:24 GMT

Yes, this is just a workaround. However, ‘msg="A script exited abnormally" input="$SPLUNK_HOME/etc/apps/splunk_instrumentation/bin/instrumentation.py" stanza="default" status="exited with code 114"’, does not indicate an actual issue. If that's what you are receiving, suppressing the message should be fine for now. From the Enterprise Security fixed issues page (SOLNESS-15251), http://docs.splunk.com/Documentation/ES/5.1.0/RN/FixedIssues, “Exit code 114 is normal for instrumentation.py and should be whitelisted”. If you are receiving a different exit code, you might have a bigger problem.

Re: Why i am getting error : msg="A script exited abnormally" input="./bin/instrumentation.py"

jamesjarrett — Tue, 29 Sep 2020 20:51:48 GMT

Check SOLNESS-15251, at SplunkES fixed issues.

The answer was posted by @donaldmurchison :

I recently had this issue on an instance with ES as well. We traced it back to the “[configuration_check://confcheck_script_errors]” stanza in inputs.conf of the ES app. It looks like this stanza was not in ES version 5.0.1.

We decided to just add instrumentation.py to the regex in the suppress setting of this stanza. The error is still included in the internal logs but doesn’t show up as a bulletin message anymore.
....

Yes, this is just a workaround. However, ‘msg="A script exited abnormally" input="$SPLUNK_HOME/etc/apps/splunk_instrumentation/bin/instrumentation.py" stanza="default" status="exited with code 114"’, does not indicate an actual issue. If that's what you are receiving, suppressing the message should be fine for now. From the Enterprise Security fixed issues page (SOLNESS-15251), http://docs.splunk.com/Documentation/ES/5.1.0/RN/FixedIssues, “Exit code 114 is normal for instrumentation.py and should be whitelisted”. If you are receiving a different exit code, you might have a bigger problem.

Re: Why i am getting error : msg="A script exited abnormally" input="./bin/instrumentation.py"

Tony_chan — Mon, 14 Jan 2019 07:20:41 GMT

We also had the same problem, but we can't find the instrumentation.py folder, and there has nothing in input.conf.
Where can we find more information about this issue.

Re: Why i am getting error : msg="A script exited abnormally" input="./bin/instrumentation.py"

ejenson_splunk — Wed, 13 Mar 2019 12:53:02 GMT

As an FYI. This issue appears to be back in ES 5.2.2 at a minimum. I have not checked versions between 5.1.0 where the issue was supposedly fixed and 5.2.2.

Re: Why i am getting error : msg="A script exited abnormally" input="./bin/instrumentation.py"

dpurtell — Wed, 22 May 2019 20:12:06 GMT

For clarification, I understand the exit code 114 is normal, but can these be suppressed from displaying in Messages? Is there an update planned to remove from showing in Messages? Thank you- Duane