Alerting

alert to remotely run a script

tmarlette
Motivator

I have created a python script in order to ssh to a remote machine and run a script on that machine to unlock user accounts.
I am only getting an return code 255.

I have eliminated all 'splunk code' from the script, and the python script by itself works just fine when ran, and unlocks the account on the remote machine. I am wondering what I am doing wrong.

I have also copied the appropriate .ssh key to the remote machines in order to remove authentication when ssh to the remote machine.

This is my script:

'''

import sys
import splunk.Intersplunk
import subprocess
import logging
import os

# System logging
logger = logging.getLogger('testssh')
hdlr = logging.FileHandler('/tmp/testssh.txt')
formatter = logging.Formatter('%(asctime)s %(levelname)s %(message)s')
hdlr.setFormatter(formatter)
logger.addHandler(hdlr)
logger.setLevel(logging.INFO)

try:

    keywords,options = splunk.Intersplunk.getKeywordsAndOptions() # Get all the options passed

    # Check for passed parameters
    if not options.has_key('host'):
        splunk.Intersplunk.generateErrorResults("no host specified")
        exit(0)
    if not options.has_key('user'):
        splunk.Intersplunk.generateErrorResults("no user specified")
        exit(0)
   if not options.has_key('command'):
        splunk.Intersplunk.generateErrorResults("no command specified")
        exit(0)

    command = options.get('command', None)
    host = options.get('host', None)
    user = options.get('user', None)

    results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults()
    for r in results:
        try:
            # Call the script passing all the necessary arguments
            p = subprocess.Popen(["ssh -i /idn/home/tmarlett/.ssh/id_rsa -q -t -t tmarlett@r[host] r[command]"],stdin=subprocess.PIPE, stdout=subprocess.PIPE,stderr=subprocess.STDOUT)
            # Get the output from script and push it to new output column
            out,err = p.communicate()
            #logger.info(out.decode("utf-8"))
            r["output"]= out.decode("utf-8")
            r["error"]=err
            r["return_code"]=p.returncode;
        except ValueError, e:
            results = splunk.Intersplunk.generateErrorResults(str(e))
        except OSError, e:
            results = splunk.Intersplunk.generateErrorResults(str(e))

    #Output results back to Splunk
    splunk.Intersplunk.outputResults(results)

except Exception, e:
    results = splunk.Intersplunk.generateErrorResults(str(e))

And this is the output it shows me when running the script:

alt text

Does anyone have any insight as to why this would be happening?

1 Solution

tmarlette
Motivator

I figured this out. This was an issue with passing ssh keys properly. Make sure the script you're using is passing the appropriate ssh key of the user that is running the Splunk instance on that search head.

View solution in original post

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...