Debugging TA_nix not reporting

[bwhite]

I edited the conf files on my local server before deploying, so I know they are all identical.

I have 5 servers.

I copied the Splunk_TA_nix folder to apps.

3 of the 5 have data showing up for the new "os" index.

splunkd.log, in fact the whole splunk/log folder, didn't have any errors.

But it also didn't have any mention of "idx=os" on the missing servers.

I ran some of the scripts in Splunk_TA_nix/bin in debug mode. No errors.

What log file or index do I check to debug the issue?

[thahir]

@bwhite have you check the internal logs for the remaining 2 server which is not reporting to splunk

[gcusello]

Hi @bwhite,

Some checks:

• have you other logs (e.g. internal or application) from the missing servers?
• did you check that the TA_nix was correctly deployed to thos servers?
• did you check that in thos servers the user runnig Splunk has the grants to read files and execute scripts?

Ciao.

Giuseppe

[bwhite]

Thanks for the reply.

I did finally get back to this issue.
I checked and noticed that the execute permissions were missing from the scripts as you mentioned.

rw-rw-rw-

Adding those permissions helped but something else was still missing that I never found.

I finally solved it by downloading it directly to the server and expanding it there instead of downloading it and unzipping it on my machine first.

Everything magically started working.

Hope that helps,
Brad.

[PickleRick]

I suppose you unpacked and re-packed the TA on a windows box. That's typical for windows to mess up with unix permissions so it's not a good idea to - for example - run windows-based deployment server for unix clients.

Anyway, instead of editing files within the app (I hope you edited the local/ files, not the default/ ones) you can create an app with configs overwriting settings from the app. This way it might be more manageable.

[gcusello]

Hi @bwhite ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉