Splunk Add-on for Microsoft Azure: "AzureWebsiteDiagnostics.py [Error 183] Cannot create a file when that file already exists"

[grzegorzgolec]

What is wrong? The add-on just stopped working.

04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py"" Traceback (most recent call last):
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py""   File "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py", line 342, in 
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py""     do_run()
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py""   File "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py", line 261, in do_run
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py""     save_checkpoint(checkpoint_dir, checkpoint_file_name, blob.properties.content_length)
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py""   File "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py", line 170, in save_checkpoint
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py""     os.rename(tmp_path, path)
04-27-2016 14:44:03.583 +0200 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-Azure\bin\AzureWebsiteDiagnostics.py"" WindowsError: [Error 183] Cannot create a file when that file already exists

[clogssplunk · Accepted solution]

I had a similar issue with running this on a Windows HF. I ended up modifying the script slightly adding the following:
Under the module import section:

 from shutil import move

Under def save_checkpoint, changing

os.rename(tmp_path, path)

to

move(tmp_path,path)

If that doesn't help another thing to check are the NTFS permissions on the App. These appear to get muddled up really easily, causing havoc.

[grzegorzgolec]

I will try it. Where is this checkpoint file? What is a path? How file is called?

splunk 6.3.3
win 2008r2 on vm in azure

[clogssplunk]

The checkpoint can be found in $SPLUNK_HOME\var\lib\splunk\modinputs, so if you used the defaults on Windows it would be

C:\Program Files\Splunk\var\lib\splunk\modinputs.

Just find the relevant folder in there.

[jconger]

What version of Windows and Splunk are you running?

The error message you are seeing has to do with checkpointing where the add-on needs to pick up at the next run. The way it works is the add-on reads what is available from the Azure blob and saves the last byte read to a checkpoint file that is local to the Splunk add-on. Then, the next time the add-on runs, it reads from this file and picks up where it left off. The error message indicates that there is an issue saving to this checkpoint file.