topic Re: alert scripts: where do stdout and stderr go in Alerting

alert scripts: where do stdout and stderr go

wegscd — Thu, 11 Sep 2014 14:32:47 GMT

I'm working on some alert scripts, and trying to get debugging information out of them.

I can't figure out where stderr and stdout are going: I write to them, but nothing shows up in the _internal logs.

Re: alert scripts: where do stdout and stderr go

hortonew — Thu, 11 Sep 2014 15:10:08 GMT

This answer may help you:

http://answers.splunk.com/answers/31262/sysstderr-not-logging-to-splunkd

Re: alert scripts: where do stdout and stderr go

wegscd — Thu, 11 Sep 2014 16:03:04 GMT

thank you. is there a posting that covers the case of alert scruipts? not seeing that mentioned in this posting (or am I missing something)?

Re: alert scripts: where do stdout and stderr go

hortonew — Thu, 11 Sep 2014 16:09:51 GMT

you can do the logging they mention in an alert script. Is your script in $SplunkHome$/bin/scripts ?

Re: alert scripts: where do stdout and stderr go

droth333 — Mon, 28 Sep 2020 19:01:54 GMT

Appears Splunk will find a triggered alert script in $SPLUNK_HOME/bin/scripts.
But if the script contains >> directs to a file (like for debugging), that file is written to $SPLUNK_HOME/etc/apps/search/bin (assuming the alert was written in search app).
Does that sound right, or expected?

Re: alert scripts: where do stdout and stderr go

kundeng — Wed, 25 May 2016 15:08:51 GMT

doesn't seem to really answer the question. I'm debugging someone's custom alert, and I don't want to change his code yet. So where are stderr stored, maybe it IS lost?

Re: alert scripts: where do stdout and stderr go

tcgerhard — Tue, 29 Sep 2020 12:20:23 GMT

The logs are ingested and can be seen via SPL:

index=_internal sourcetype=splunkd component=sendmodalert action="{action}"

See http://docs.splunk.com/Documentation/Splunk/6.4.2/AdvancedDev/ModAlertsLog#Access_alert_action_script_logs