All Apps and Add-ons

Splunk DB Connect 2 ConfPathMapper and ExecProcessor Errors

rmsit
Communicator

Hi, all.

I receiving the following errors in Splunk after enabling several database inputs which do work. I have reinstalled the latest app version with the same results. Any ideas on the cause?

05-30-2016 15:46:09.929 -0400 ERROR ExecProcessor - message from "python "D:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" Degrade mode - ENTERING - (pid=8512) rename failed. File in use? exception=[Error 32] The process cannot access the file because it is being used by another process

05-30-2016 15:46:09.686 -0400 ERROR ExecProcessor - message from "python "D:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" Degrade mode - ENTERING - (pid=4804) rename failed. File in use? exception=[Error 32] The process cannot access the file because it is being used by another process

05-30-2016 15:46:08.902 -0400 ERROR ConfPathMapper - ConfPathMapper: D:\Program Files\Splunk\etc\apps\splunk_app_db_connect\local: Refused forced reload of inputs.conf: outstanding write

Thank you

Tags (1)

Muryoutaisuu
Communicator

I opened a case because of this.

It seems the message is logged with wrong loglevel. It should be warning instead of error. (information from support)
The Problem is caused by too many checkpoint value updates. If you have several db inputs with a lot of data, but a very small fetch size, it will be updated a lot, thus causing write locks on the inputs.conf file.

Try to balance the fetch size, interval and the JVM Heapsize (tip from splunk support)

Background information: The checkpoint value from each db input is saved in memory. On update it is written to the inputs.conf file. If the inputs.conf file is locked, the checkpoint value in inputs.conf will not be updated. splunkd will try to update the checkpoint value on next update.
I suspect, if splunkd were to crash before writing the updated checkpoint to inputs.conf, it might cause duplicate events on next db input run. NOT CONFIRMED

Kind regards
Muryoutaisuu

0 Karma

ehudb
Contributor

Hello
Did you find a solution for this error?

0 Karma

rmsit
Communicator

I did not. Splunk support recommended I upgrade to the latest app version, which I did, but I still saw the errors. I did notice the file system permissions (for me Windows) were not consistent throughout the app's subdirectories which resolve the other issue I was having with files in /local not being read.

Hope this helps...

Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...