Splunk add-on for Microsoft Cloud Services - No handlers could be found for logger "msrestazure.azure_active_directory"

[jldgomes]

Hello everyone

I have installed this addon and even before I configure it, it is throwing these errors on a constant basis:

02-15-2019 16:48:06.847 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/mscs_azure_audit.py" No handlers could be found for logger "msrestazure.azure_active_directory"
02-15-2019 16:48:06.955 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/mscs_azure_resource.py" No handlers could be found for logger "msrestazure.azure_active_directory"

Has anyone faced this issue before?

If I run the script manually, I get the same error:

./splunk cmd python /opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/bin/mscs_azure_audit.py
No handlers could be found for logger "msrestazure.azure_active_directory

I already removed and reinstalled the addon, restarted splunk but the error persists.

Thanks

[adobrzeniecki_s]

Hello All, this issue has been resolved in the latest release of the Splunk Add-on For Microsoft Cloud Services 3.1.0. Please see the link below with this issue being fixed! Make sure you are on the latest version of the TA.

https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Releasenotes#Fixed_issues

[rkantamaneni_sp]

Fixed issues:

Version 3.1.0 of the Splunk Add-on for Microsoft Cloud Services fixes the following issues:

Date resolved | Issue number | Description
2019-02-08| ADDON-20248 | Getting ERROR "No handlers could be found for logger" in splunkd.log file after installation of MSCS Add-On

[rkantamaneni_sp]

Hi,

Not sure if this is related, but there is a bug, ADDON-21292, in the Splunk Add-On MSCS v3.0.0 where inputs are disabled by default when creating them.

If you could go to the the $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-cloudservices/local/inputs.conf file, and edit the value:

disabled = 1 to disabled = 0

for all stanzas (guessing they should all be enabled) though for this error it's probably the rest stanza:

[rest:<your input>]

[<all other stanzas>]

Please try this change(s) and let us know if this resolves your issue.

[johnward4]

I'm having the same issue, please help if anyone knows why