All Apps and Add-ons

Certificate Transparency Errors

liquidclay23
Explorer

Hello All,

I have completed two separate installs of this app on different servers and then upgraded from Splunk 6 to 7. Both times I am getting the expected CT logs but I am also seeing a lot of internal errors. I see the exact same errors on both servers:

Are other people also seeing this, is this keeping me from collecting all the data I should be seeing? Thanks,

message from "python ../TA-ct-log/bin/ct_log.py" input_module.collect_events(self, ew)
message from "python ../TA-ct-log/bin/ct_log.py" obj, end = self.raw_decode(s, idx=w(s, 0).end())
message from "python ../TA-ct-log/bin/ct_log.py" obj.process_log()
message from "python ../TA-ct-log/bin/ct_log.py" raise ValueError("No JSON object could be decoded")
message from "python ../TA-ct-log/bin/ct_log.py" return _default_decoder.decode(s)
message from "python ../TA-ct-log/bin/ct_log.py" self.collect_events(ew)
message from "python ../TA-ct-log/bin/ct_log.py" sth = json.loads(r.text)
message from "python ../TA-ct-log/bin/ct_log.py" tree_size = self.get_tree_size()
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py", line 64, in collect_events
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ctl/ctl2splunk.py", line 169, in get_tree_size
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ctl/ctl2splunk.py", line 201, in process_log
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/input_module_ct_log.py", line 26, in collect_events
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ta_ct_log/modinput_wrapper/base_modinput.py", line 127, in stream_events
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/lib/python2.7/json/
init_.py", line 339, in loads
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/lib/python2.7/json/decoder.py", line 364, in decode
message from "python ../TA-ct-log/bin/ct_log.py" File "/opt/splunk/lib/python2.7/json/decoder.py", line 382, in raw_decode
message from "python ../TA-ct-log/bin/ct_log.py" ERRORNo JSON object could be decoded
message from "python ../TA-ct-log/bin/ct_log.py" Traceback (most recent call last):
message from "python ../TA-ct-log/bin/ct_log.py" ValueError: No JSON object could be decoded

I am just showing the message field to fit on the screen. All evens are coming in as component=ExecProcessor and log_level=ERROR

0 Karma

jorritf
Path Finder

Can you try if version 1.3.0 (on Github only) fixes this for you?
If so, I'll publish it on Splunkbase

0 Karma

liquidclay23
Explorer

Thank you for your response jorritf. I uploaded the version of the app in GIT and immediately saw a significant improvement. Prior I was seeing about 684 errors a day. I am only seeing 18 errors since I upgraded yesterday.

component log_level event_message count
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" Traceback (most recent call last): 2
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" input_module.collect_events(self, ew) 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" obj.process_log() 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" os.rename(sfn, dfn) 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" raise Exception("Error saving checkpoint data with with exception %s" % str(e)) 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" self.collect_events(ew) 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" self.doRollover() 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py", line 64, in collect_events 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ctl/ctl2splunk.py", line 254, in process_log 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/input_module_ct_log.py", line 23, in collect_events 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" File "/opt/splunk/etc/apps/TA-ct-log/bin/ta_ct_log/modinput_wrapper/base_modinput.py", line 127, in stream_events 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" File "/opt/splunk/lib/python2.7/logging/handlers.py", line 136, in doRollover 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" File "/opt/splunk/lib/python2.7/logging/handlers.py", line 77, in emit 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" ERRORError saving checkpoint data with with exception ('Connection aborted.', BadStatusLine("''",)) 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" Exception: Error saving checkpoint data with with exception ('Connection aborted.', BadStatusLine("''",)) 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" Logged from file base_modinput.py, line 293 1
ExecProcessor ERROR message from "python /opt/splunk/etc/apps/TA-ct-log/bin/ct_log.py" OSError: [Errno 2] No such file or directory

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...