All Apps and Add-ons

Problem with nfs-iostat_sos.py on OpenIndiana/Solaris

deejay1
Explorer

The script fails when run on Solaris/OpenIndiana with:

03-13-2014 11:43:30.257 +0100 ERROR ExecProcessor - message from "/splunk/search_head_pool/etc/apps/sos/bin/ps_sos.sh" sh: line 1: /usr/ucb/ps: not found
03-13-2014 11:43:30.382 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py" Traceback (most recent call last):
03-13-2014 11:43:30.382 +0100 ERROR ExecProcessor - message from "python /splunk_shared/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py"   File "/splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py", line 646, in <module>
03-13-2014 11:43:30.382 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py"     iostat_command(prog)
03-13-2014 11:43:30.382 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py"   File "/splunk_shared/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py", line 518, in iostat_command
03-13-2014 11:43:30.382 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py"     mountstats = parse_stats_file('/proc/self/mountstats')
03-13-2014 11:43:30.382 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py"   File "/splunk_shared/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py", line 427, in parse_stats_file
03-13-2014 11:43:30.382 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py"     f = file(filename)
03-13-2014 11:43:30.382 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py" IOError: [Errno 2] No such file or directory: '/proc/self/mountstats'
03-13-2014 11:43:35.319 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py" Traceback (most recent call last):
03-13-2014 11:43:35.319 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py"   File "/splunk_shared/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py", line 646, in <module>
03-13-2014 11:43:35.319 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py"     iostat_command(prog)
03-13-2014 11:43:35.320 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py"   File "/splunk_shared/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py", line 518, in iostat_command
03-13-2014 11:43:35.320 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py"     mountstats = parse_stats_file('/proc/self/mountstats')
03-13-2014 11:43:35.320 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py"   File "/splunk_shared/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py", line 427, in parse_stats_file
03-13-2014 11:43:35.320 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py"     f = file(filename)
03-13-2014 11:43:35.320 +0100 ERROR ExecProcessor - message from "python /splunk/search_head_pool/etc/apps/sos/bin/nfs-iostat_sos.py" IOError: [Errno 2] No such file or directory: '/proc/self/mountstats'

The search head pool consists of both OpenIndiana hosts and Linux hosts and enabling the script on one of them enables it on both, so I can't exclude it. Any hints?

hexx
Splunk Employee
Splunk Employee

This script was not designed to run on systems other than Linux, so it's not entirely surprising that it wouldn't work on Solaris.

I think you should be able to locally disable the execution of the scripted input on your Solaris instance in $SPLUNK_HOME/etc/system/local/inputs.conf rather than on the pool shared directory.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...