All Apps and Add-ons

Problems to collect logs from checkpoint OP SEC

Explorer

Hello!

We have a problem with OP SEC LEA, the splunk restarted for a problem of storage because is over a Centos7, since there we cant collect logs from checkpoint and we have the next message.

2019-05-10 17:59:58,532 +0000 loglevel=ERROR, pid=2081, tid=Thread-4, file=tadatacollector.py, funcname=indexdata, codelineno=108 | [inputname="livecheckpointfixednew1" data="nonaudit"] Failed to index data, reason:
Traceback (most recent call last):
File "/opt/splunk/etc/apps/SplunkTAcheckpoint-opseclea/bin/splunktacheckpointopseclea/splunktaucclib/datacollection/tadatacollector.py", line 105, in indexdata
self.
dosafeindex()
File "/opt/splunk/etc/apps/SplunkTAcheckpoint-opseclea/bin/splunktacheckpointopseclea/splunktaucclib/datacollection/tadatacollector.py", line 148, in dosafeindex
self.
client = self.createdataclient()
File "/opt/splunk/etc/apps/Splunk
TAcheckpoint-opseclea/bin/splunktacheckpointopseclea/splunktaucclib/datacollection/tadatacollector.py", line 73, in _createdataclient
ckpt = self.
getckpt()
File "/opt/splunk/etc/apps/Splunk
TAcheckpoint-opseclea/bin/splunktacheckpointopseclea/splunktaucclib/datacollection/tadatacollector.py", line 64, in _getckpt
return self.checkpointmanager.getckpt()
File "/opt/splunk/etc/apps/Splunk
TAcheckpoint-opseclea/bin/splunktacheckpointopseclea/splunktaucclib/datacollection/tacheckpointmanager.py", line 32, in getckpt
return self.store.getstate(key)
File "/opt/splunk/etc/apps/SplunkTAcheckpoint-opseclea/bin/splunktacheckpointopseclea/splunktalib/statestore.py", line 202, in getstate
state = json.load(jsonfile)
File "/opt/splunk/lib/python2.7/json/
init.py", line 291, in load
**kw)
File "/opt/splunk/lib/python2.7/json/
init.py", line 339, in loads
return _default
decoder.decode(s)
File "/opt/splunk/lib/python2.7/json/decoder.py", line 364, in decode
obj, end = self.rawdecode(s, idx=w(s, 0).end())
File "/opt/splunk/lib/python2.7/json/decoder.py", line 382, in raw_decode
raise ValueError("No JSON object could be decoded")
ValueError: No JSON object could be decoded

We hope someone can help us.

Regards.

0 Karma