ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/interfaces.sh" cat: /sys/class/net/eth#/speed: Invalid argument

[jlstanley]

Getting error on many servers about :
ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/interfaces.sh" cat: /sys/class/net/eth7/speed: Invalid argument
the nic with vary so it' s not always eth7.

anyone know how to fix offhand?

[nunoaragao]

cat: /sys/class/net/eth7/speed: will return Invalid argument if the NIC is disconnected. Same for duplex.
The way I fixed this, was to previously check if the state is "Up", like this

if [ -r /sys/class/net/$iface/duplex ]; then
         if grep -Fq "up" /sys/class/net/$iface/operstate; then
                     DUPLEX=`cat /sys/class/net/$iface/duplex | sed 's/./\u&/'`
                     [ .... more original code here .... ]
         fi

Other lines of code might also do the trick

[jlstanley]

I'm wondering if the version 7 of the add-on for Unix and Linux fixes it? if not, I'll give this a try. thanks

[esalesapns2]

My interface is showing "up", but I'm getting errors for "speed" and "duplex", even if I cat them from the command line; I'm running on a fairly recent Splunk AMI in AWS, One wonders why Splunk hasn't seen/fixed this?

[nunoaragao]

I've hit the same snag on some AMI on AWS. Could not figure out an elegant solution, so I've resorted to:
DUPLEX=cat /sys/class/net/$iface/duplex 2>/dev/null | sed 's/./\u&/'
...
SPEED=cat /sys/class/net/$iface/speed 2>/dev/null

Which redirects the errors to dev null. That was Splunk's implementation back on version 5 of the add-on.

[wfrankl2]

I get the same thing but not just for speed. duplex and docker0