All Apps and Add-ons

Splunk Add-on for Microsoft Azure: "AzureWebsiteDiagnostics.py [Error 183] Cannot create a file when that file already exists"

grzegorzgolec
New Member

What is wrong? The add-on just stopped working.

04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py"" Traceback (most recent call last):
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py""   File "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py", line 342, in 
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py""     do_run()
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py""   File "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py", line 261, in do_run
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py""     save_checkpoint(checkpoint_dir, checkpoint_file_name, blob.properties.content_length)
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py""   File "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py", line 170, in save_checkpoint
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py""     os.rename(tmp_path, path)
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py"" WindowsError: [Error 183] Cannot create a file when that file already exists
0 Karma
1 Solution

clogssplunk
Explorer

I had a similar issue with running this on a Windows HF. I ended up modifying the script slightly adding the following:
Under the module import section:

 from shutil import move

Under def save_checkpoint, changing

os.rename(tmp_path, path)

to

move(tmp_path,path)

If that doesn't help another thing to check are the NTFS permissions on the App. These appear to get muddled up really easily, causing havoc.

View solution in original post

0 Karma

clogssplunk
Explorer

I had a similar issue with running this on a Windows HF. I ended up modifying the script slightly adding the following:
Under the module import section:

 from shutil import move

Under def save_checkpoint, changing

os.rename(tmp_path, path)

to

move(tmp_path,path)

If that doesn't help another thing to check are the NTFS permissions on the App. These appear to get muddled up really easily, causing havoc.

0 Karma

grzegorzgolec
New Member

I will try it. Where is this checkpoint file? What is a path? How file is called?

splunk 6.3.3
win 2008r2 on vm in azure

0 Karma

clogssplunk
Explorer

The checkpoint can be found in $SPLUNK_HOME\var\lib\splunk\modinputs, so if you used the defaults on Windows it would be

C:\Program Files\Splunk\var\lib\splunk\modinputs.

Just find the relevant folder in there.

0 Karma

jconger
Splunk Employee
Splunk Employee

What version of Windows and Splunk are you running?

The error message you are seeing has to do with checkpointing where the add-on needs to pick up at the next run. The way it works is the add-on reads what is available from the Azure blob and saves the last byte read to a checkpoint file that is local to the Splunk add-on. Then, the next time the add-on runs, it reads from this file and picks up where it left off. The error message indicates that there is an issue saving to this checkpoint file.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...