Loss of connection after few hours to ITM CQ server

[splunkreal]

Hello,

we lose connection trying to collect data with the DASH input. We are using Splunk 6.5.2

Also when trying to use the input, we get 500 error in web_service.log (see attached)link text

Restarting the itm cq server resolves the problem, any idea?

Thanks.

[kierencrossland · Accepted solution]

Hi,

I have been looking into an issue where the TEPS begins to run out of memory after many dash requests. I think we have managed to fix this, but I havent had chance to update the app in splunkbase.

If you want to apply this manually then download itm.zip and place the files in the following dirs:

$splunkhome/etc/apps/ITM6/bin/itmdash.py
$splunkhome/etc/apps/ITM6/bin/itm6/dash.py

I'd be interested to see if that clears up your issue.

When the splunk app stops working, are you able to manually get data back from the dashboard data provider using curl? For example listing systems:

curl -G -u '$user:$password' --data-urlencode properties=all -k http://$host:15200/ibm/tivoli/rest/providers/itm.$temsname/datasources/TMSAgent.%26IBM.STATIC000/dat...

[splunkreal]

Hi Kieren,

there is a problem adding those files :

Unable to initialize modular input "itm6_dash_input" defined inside the app "ITM6": Introspecting scheme=itm6_dash_input: script running failed (exited with code 1).
from itm6.dash import dash as itm6_dash
return self.request(endpoint='datasources/%s/datasets/mgrp/items' % datasource, payload={'properties':'MGROUP', 'param_Refresh':0}})
File "/OPT/siem/splunk/etc/apps/ITM6/bin/itm6/dash.py", line 83
File "/OPT/siem/splunk/etc/apps/ITM6/bin/itmdash.py", line 6, in
External search command 'itmdash' returned error code 1.
SyntaxError: invalid syntax

Thanks for your help.

[kierencrossland]

Apologies for that. There appears to be a stray } on lines 83 and 89 on the copy of that code on my git.

Are you able to change 83 to:
return self.request(endpoint='datasources/%s/datasets/mgrp/items' % datasource, payload={'properties':'MGROUP', 'param_Refresh':0})

and 89 to:
return self.request(endpoint='datasources/%s/datasets/msys/items' % datasource,payload={'properties':'ORIGINNODE', 'param_Refresh':0})

[splunkreal]

Hi Kieren,

the memory/vcpu upgrade yesterday solved already the problem. I applied your patch anyway 🙂 Thanks a lot.

Maybe you could give some recommendations regarding memory to use correctly your app.

That's great job anyway!