All Apps and Add-ons

S.O.S 3.1 Upgrade on Windows 2008 R2

rmsit
Communicator

Hello, I just upgraded S.O.S to 3.1, and I now receive an ExecProcessor error of:

You cannot call a method on a null-valued expression at line:1 char:2

Metrics do display correctly but this error is new for me.

Thanks,
James

hexx
Splunk Employee
Splunk Employee

UPDATE: The latest version of the S.o.S app and of its add-on for Windows have now been released and fix this particular issue.


These errors occur when the execution of the ps_sos.ps1 scripted input fails because the Get-Process Powershell cmdlet somehow returns an empty set.

We are still tracking down the root cause for that particular problem, which will cause ps_sos.ps1 to intermittently fail to return output. We have a bug opened against S.o.S (internal reference - SUP-812) to track down this investigation.

It is very unlikely that we will be able to influence the behavior of the Get-Process cmdlet on which the script heavily relies, so the best we can hope for is:
* Better handling of the situation where Get-Process returns an empty set. Perhaps the best course of action is for ps_sos.ps1 to produce no output and to log a warning to splunkd.log.
* Mitigation of the error, ideally by discovering how it is triggered. Our suspicion right now is that this can occur when the script takes too long to run. A longer interval for the scripted input (10s instead of 5s) may help here.

hexx
Splunk Employee
Splunk Employee

I have put the latest version of ps_sos.ps1 on box for you:

https://splunk.box.com/s/t89sirx2v0d7a5quzgc3

0 Karma

meatonium
New Member

The latest version of SOS has a version of sos.ps1 that was last edited in October '13 - any chance you could post the changes that fixed up the initial issue?

0 Karma

hexx
Splunk Employee
Splunk Employee

Based on internal testing, we believe that we have addressed this issue. The fix will be delivered in the next release of S.o.S, which is due in the next few months.

If you'd like, I can make a copy of the fixed up ps_sos.ps1 available to any interested parties who would like to test it.

laserval
Communicator

Any news regarding this issue? I'm seeing it quite a lot, making the CPU and memory graphs in SoS jumo around a bit. I think returning no output makes the most sense, or retrying the call to Get-Process.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...