All Apps and Add-ons

Splunk Add-on for Microsoft Active Directory filling up local disk with .tmp files

elvisramos21
Engager

Hello,

We have this add-on installed (version 1.0.0) and there are tmp files being created on some Active Directory servers but not being removed. The content of the tmp files are as follows:

constants
SplunkCheckpointPath:C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\powershell
SplunkHome:C:\Program Files\SplunkUniversalForwarder
SplunkServerHost:host1234
SplunkServerName:host1234
SplunkServerUri:https://127.0.0.1:8089
SplunkSessionKey:sessionkey
stanzas
stanza:AD-Health
event_group:-1,1
index:msad
script:& "$SplunkHome\etc\apps\Splunk_TA_microsoft_ad\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-health.ps1"
source:Powershell
sourcetype:MSAD:NT6:Health
stanza:Replication-Stats
event_group:-1,2
index:msad
script:& "$SplunkHome\etc\apps\Splunk_TA_microsoft_ad\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-repl-stats.ps1"
source:Powershell
sourcetype:MSAD:NT6:Replication
stanza:Siteinfo
event_group:-1,3
index:msad
script:& "$SplunkHome\etc\apps\Splunk_TA_microsoft_ad\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-siteinfo.ps1"
source:Powershell
sourcetype:MSAD:NT6:SiteInfo

Can someone please help investigate what is causing this? I suspect that the logging is not configured correctly here.

0 Karma
1 Solution

elvisramos21
Engager

Hi,

This issue is being caused because the execution of Powershell scripts was disabled on our servers.

We were able to capture this by running the ./splunk diag on the server in question. We see this error many times:

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe""  be loaded because the execution of scripts is disabled on this system. 

The issue has been resolved using the following steps:

http://docs.splunk.com/Documentation/SoS/3.2.1/SoSGuide/Postinstall#Enable_local_PowerShell_script_e...

Hope this helps!

View solution in original post

elvisramos21
Engager

Hi,

This issue is being caused because the execution of Powershell scripts was disabled on our servers.

We were able to capture this by running the ./splunk diag on the server in question. We see this error many times:

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe""  be loaded because the execution of scripts is disabled on this system. 

The issue has been resolved using the following steps:

http://docs.splunk.com/Documentation/SoS/3.2.1/SoSGuide/Postinstall#Enable_local_PowerShell_script_e...

Hope this helps!

baseballnut8200
Explorer

Has anyone found an answer to this? I have a system that is doing the same thing, and it is dumping the file into c:\windows\temp. It is doing it some fast that the box is running out of free space on the system. I have looked thru the script, but don't see any reference that would cause it to dump files there. Any help on this will be greatly appreciated it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...