All Apps and Add-ons

Cisco eStreamer eNcore issues

molinarf
Communicator

New issue for me after getting back to try and make this work.

1) I am not able to get splencore.sh to start. It fails at trying to process the pkcs12 file saying that there is a possible password problem. Not using any password.
2) No configuration log is generated.

Currently using Splunk 7.1.3 and FMC 6.2.3.5

0 Karma

douglashurd
Builder

We have a developer looking at outstanding issues currently.

CLI version 3.5.4 is here BTW: https://github.com/CiscoSecurity/fp-05-firepower-cef-connector-arcsight

0 Karma

molinarf
Communicator

The more I dig, it seems that eStreamer (slencore.sh) is assuming that the server is running Python 2.7 in its OS, rather than picking it up from Splunk. When I have looked at the encore.sh script, in the init section, it actually goes out and looks for Python 2.7 'pythonVersion='pybin -V 2>&1 | grep "Python 2.7"'. However, that may not actually get it to use Python 2.7 located in /opt/splunk/bin. Is there a way to change the variable pybin="python" to the actual location of Splunk's python, then it might work.

0 Karma

molinarf
Communicator

lakshman,

I tried what you posted. This is what it now looks like

basepath="$SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore"
datafilepath="$SPLUNK_HOME/etc/apps/TA-eStreamer/data"
isRunning=0

I modified the clean statement so that it looks like what you have.

I still ended up with the same error... "/etc/apps/TA-eStreamer/bin/encore "doesn't exist"

I had updated to TA-eStreamer 3.5.4 hoping that the problem would clear, but it doesn't.
Today, I will try to update Splunk to 7.2.1 hoping for better results, but not holding my breath.

Let me know if I did anything wrong. I can provide the splencore.sh file if you would like to see it.

Thanks for the help.

0 Karma

lakshman239
Influencer

I had seen similar issue with TA-eStreamer v3.0. So, I fixed the issue by updating the splencore.sh file: [ DougHard can review and add to next version of the TA]. It seems the script is unable to resolve the path, so I had to update them explicitly.

basepath="$SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore"
datafilepath="$SPLUNK_HOME/etc/apps/TA-eStreamer/data"

Also, on the clean() stanza, i had to update it to allow the files per available disk space

clean() {
#configure retention period as needed
if [ "$(ls -A $datafilepath)"]
then
find ../../data/encore*.log -type f -mmin +120 -delete
fi
}

Hope this helps.

0 Karma

molinarf
Communicator

lakshman

After all that, I decided to change the relative path "$SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore" to the explicit path "/opt/splunk/etc/apps/TA-eStreamer/bin/encore" and I was able to run the test even through it failed. Unfortunately, it started with this message: "This software is currently only compatible with Pyhon 2.7. You are running 2.6.6. I have Splunk running on RHEL 6.9 It started the diagnostic portion anyway, and when it wanted the password for the client.pkcs12, there was this message:
/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/crossprocesslogging/baseClient.py:35: DeprecationWarning: BaseExceptionmessage has been deprecated as of Python 2.6.

Any ideas?

0 Karma

douglashurd
Builder

you have to set $SPLUNK_HOME to the path of where splunk is installed (usually opt/splunk, depends on OS)

Is this where splunk is installed? Did you move to Python 2.7?

0 Karma

lakshman239
Influencer

try to upgrade to python 2.7 and go through operations guide to ensure you meet all pre-reqs. https://community.cisco.com/t5/security-documents/estreamer-encore-operations-guide-3-0/ta-p/3193939

0 Karma

molinarf
Communicator

I have returned to working on this issue. I am now running Splunk 7.2.0 and FMC 6.3. I uninstalled eStreamer eNcore and reinstalled. I used 3.5.3. I still have the same issue when trying to get eNcore to work. I did notice when I was using the CLI something different that may be a reason why this is failing. When I ran ./splencore.sh test, the error "/etc/apps/TA-eStreamer/bin/encore "doesn't exist". I can see the directory. I opened up the file and found that line 12 establishes the variable for basepath="$SPLUNk_HOME/et/apps/TA-eStreamer/bin/encore".

This is lines 25-32
init() {
# change pwd
if [ -d $basepath ]
then
cd $basepath

else
echo "\"$basepath\" does not exist"
exit $EXIT_CODE_ERROR

The above if/else statements are also found in the configure.sh script.

Anyone have any ideas how to correct this?

Thank you.

0 Karma

douglashurd
Builder

Did you get past the password issue? You need authenticate the TA with the FMC or it will not work.

0 Karma

molinarf
Communicator

update: I am now running Splunk 7.2.0.

0 Karma

plymalebl
Explorer

I know this is an old thread, but just ran into this in my own instance running Splunk 8.2.8 and Cisco eStreamer eNcore for Splunk (3.7.4). The problem is that in the encore.conf file it is using a different file path than what is in the splencore.sh for datapath. That is why the clean-up script isn't working properly.

"uri": "relfile:///../../data/encore.{0}.log" } } ],

The file location is different than what is in the default.conf and is causing it to save data in the full path of $SPLUNK_HOME/etc/apps/TA-eStreamer/data rather than the clean hardcoded path in the app of /opt/splunk/etc/apps/TA-eStreamer/bin/encore/data

Hopefully this will help someone else get their system cleaning data properly. Either adjust the value in encore.conf or adjust the clean path in splencore.sh to the appropriate location.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...