Splunk Add-on for Microsoft Active Directory filling up local disk with .tmp files

[elvisramos21]

Hello,

We have this add-on installed (version 1.0.0) and there are tmp files being created on some Active Directory servers but not being removed. The content of the tmp files are as follows:

constants
SplunkCheckpointPath:C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\powershell
SplunkHome:C:\Program Files\SplunkUniversalForwarder
SplunkServerHost:host1234
SplunkServerName:host1234
SplunkServerUri:https://127.0.0.1:8089
SplunkSessionKey:sessionkey
stanzas
stanza:AD-Health
event_group:-1,1
index:msad
script:& "$SplunkHome\etc\apps\Splunk_TA_microsoft_ad\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-health.ps1"
source:Powershell
sourcetype:MSAD:NT6:Health
stanza:Replication-Stats
event_group:-1,2
index:msad
script:& "$SplunkHome\etc\apps\Splunk_TA_microsoft_ad\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-repl-stats.ps1"
source:Powershell
sourcetype:MSAD:NT6:Replication
stanza:Siteinfo
event_group:-1,3
index:msad
script:& "$SplunkHome\etc\apps\Splunk_TA_microsoft_ad\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-siteinfo.ps1"
source:Powershell
sourcetype:MSAD:NT6:SiteInfo

Can someone please help investigate what is causing this? I suspect that the logging is not configured correctly here.

[elvisramos21 · Accepted solution]

Hi,

This issue is being caused because the execution of Powershell scripts was disabled on our servers.

We were able to capture this by running the ./splunk diag on the server in question. We see this error many times:

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe""  be loaded because the execution of scripts is disabled on this system. 

The issue has been resolved using the following steps:

http://docs.splunk.com/Documentation/SoS/3.2.1/SoSGuide/Postinstall#Enable_local_PowerShell_script_e...

Hope this helps!

[baseballnut8200]

Has anyone found an answer to this? I have a system that is doing the same thing, and it is dumping the file into c:\windows\temp. It is doing it some fast that the box is running out of free space on the system. I have looked thru the script, but don't see any reference that would cause it to dump files there. Any help on this will be greatly appreciated it.