Quarantine files framework - Unexpected error during execution

pellegrini — Fri, 07 Jun 2024 09:16:24 GMT

Following two error repeats every minute in splunkd.log on Splunk Enterprise

What is causing this?

06-07-2024 10:45:00.314 +0200 ERROR ExecProcessor [2519201 ExecProcessorSchedulerThread] - message from "/data/splunk/bin/python3.7 /data/splunk/etc/apps/search/bin/quarantine_files.py" Quarantine files framework - Unexpected error during execution: Expecting value: line 1 column 1 (char 0) 06-07-2024 10:45:00.314 +0200 ERROR ExecProcessor [2519201 ExecProcessorSchedulerThread] - message from "/data/splunk/bin/python3.7 /data/splunk/etc/apps/search/bin/quarantine_files.py" Quarantine files framework - Setting enable_jQuery2 - Unexpected error during execution: Expecting value: line 1 column 1 (char 0)

Re: Quarantine files framework - Unexpected error during execution

pellegrini — Fri, 07 Jun 2024 13:18:04 GMT

In this case a full file systems caused this file below to be empty, even after splunkd restart, it was still empty.. That was the cause of this error:

[splunk@hf001 ~]$ ll /opt/splunk/quarantined_files/ total 8 -rwxr-x--- 1 splunk splunk 0 Jun 7 14:18 quarantine_manifest.json -rwxr-x--- 1 splunk splunk 208 Mar 16 2023 README.md

Adding Enterprise default config to the file solved the issue:

[splunk@hf001 ~]$ cat /opt/splunk/quarantined_files/quarantine_manifest.json {"enable_jQuery2": "not-restricted", "enable_unsupported_hotlinked_imports": "not-restricted"}

topic Quarantine files framework - Unexpected error during execution in Monitoring Splunk

Quarantine files framework - Unexpected error during execution

Re: Quarantine files framework - Unexpected error during execution