All Apps and Add-ons

Splunk add-on for Microsoft Cloud Services - No handlers could be found for logger "msrestazure.azure_active_directory"

jldgomes
Engager

Hello everyone

I have installed this addon and even before I configure it, it is throwing these errors on a constant basis:

02-15-2019 16:48:06.847 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/mscs_azure_audit.py" No handlers could be found for logger "msrestazure.azure_active_directory"
02-15-2019 16:48:06.955 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/mscs_azure_resource.py" No handlers could be found for logger "msrestazure.azure_active_directory"

Has anyone faced this issue before?

If I run the script manually, I get the same error:

./splunk cmd python /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/mscs_azure_audit.py
No handlers could be found for logger "msrestazure.azure_active_directory

I already removed and reinstalled the addon, restarted splunk but the error persists.

Thanks

adobrzeniecki_s
Splunk Employee
Splunk Employee

Hello All, this issue has been resolved in the latest release of the Splunk Add-on For Microsoft Cloud Services 3.1.0. Please see the link below with this issue being fixed! Make sure you are on the latest version of the TA.

https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Releasenotes#Fixed_issues

rkantamaneni_sp
Splunk Employee
Splunk Employee

Fixed issues:

Version 3.1.0 of the Splunk Add-on for Microsoft Cloud Services fixes the following issues:

Date resolved | Issue number | Description
2019-02-08| ADDON-20248 | Getting ERROR "No handlers could be found for logger" in splunkd.log file after installation of MSCS Add-On

0 Karma

rkantamaneni_sp
Splunk Employee
Splunk Employee

Hi,

Not sure if this is related, but there is a bug, ADDON-21292, in the Splunk Add-On MSCS v3.0.0 where inputs are disabled by default when creating them.

If you could go to the the $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-cloudservices/local/inputs.conf file, and edit the value:

disabled = 1 to disabled = 0

for all stanzas (guessing they should all be enabled) though for this error it's probably the rest stanza:

[rest:<your input>]

[<all other stanzas>]

Please try this change(s) and let us know if this resolves your issue.

0 Karma

johnward4
Communicator

I'm having the same issue, please help if anyone knows why

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...