Experiencing error: splunk-monitornohandle - configure: no drive specifier found

[suzakutheknight]

We are receinving the error below in our environment after deploying the Splunk Add-on for Microsoft Windows:

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - configure: no drive specifier found: '$windir\system32\dns\dns.log'

The target systems are running Windows Server 2012 R2 Standard, and the universal forwarder is running as the local system account.

Splunk Component Versions:
Splunk Enterprise 8.0.1
Splunk Universal Forwarder 7.3.4
Splunk Add-on for Microsoft Windows 7.0.0

Any guidance on troubleshooting this would be greatly appreciated.

[LeandroKopke]

Hello everyone!

I'm also having issues for DNS Debug logs and getting this same error
Besides this adjustment, is there anything else to do?

I already changed the input "MonitorNoHandle://$WINDIR\System32\Dns\dns.log" to "MonitorNoHandle://C:\Windows\System32\Dns\dns.log" and vice versa, but it didn't work for "MonitorNoHandle ". Would it be a bug known?

ERROR ExecProcessor [19092 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - configure: Failed to create local heap. Error=(0x8)

Thanks!

[jwiedow · Accepted solution]

If you change the monitor stanza to use the actual drive letter (C:\Windows) instead of $windir does it work?

[suzakutheknight]

Sorry for the delay, I wanted to run the updated configuration for long enough to validate the change.

Updating the input from "MonitorNoHandle://$WINDIR\System32\Dns\dns.log" to "MonitorNoHandle://C:\Windows\System32\Dns\dns.log" does indeed resolve the issue. What's really odd though is the $WINDIR variable seems to be working in other inputs. For example, "monitor://$WINDIR\WindowsUpdate.log" being enabled does not generate the error.

My guess is that the issue is something specific to the resolution of environment variables by the MonitorNoHandle process. While all of our systems do have C: for the OS drive, it would be more ideal to use the environment variable to protect against edge cases. Is there any thing else we can do to troubleshoot further, or is it time for a bug report?

[jwiedow]

Good to know. Have you tried 8.0.0 of the Splunk Add-on for Microsoft Windows and seen if the issue persists there with the variable substitution?

[warwicks]

Can confirm the issue persists for the [MonitorNoHandle://$WINDIR\System32\Dns\dns.log] input in v8.2.0 of the Windows TA.
This input resolves $WINDIR fine [monitor://$WINDIR\debug\netlogon.log] but as per the OP this input does not  [MonitorNoHandle://$WINDIR\System32\Dns\dns.log].

[suzakutheknight]

We have not. I'll get that and updating the Windows Server 2012 forwarders to 7.3.5 onto our patching schedule to see if either resolves the issue. Given that will not be a swift process due to some bureaucracy, would it be best to mark this question as resolved with removing the environmental variable as a work around solution?

[jwiedow]

I would try to test it on at least one test server and see if it resolves the problem. I don't see anything in the release notes about it fixing an issue with the monitor-nohandle but that doesn't necessarily mean anything.

The quickest thing to do is to open a support case with the information and see if they are aware of the issue. It definitely sounds like a bug.

[SUNDAY]

Just a thought - what if the $WINDIR resolves correctly in all cases, but the file or folder is actually missing, and the error message is misleading? 

Has it been checked that both $WINDIR\debug\netlogon.log and $WINDIR\syetem32\dns\dns.log exist and are readable?