TA-DMARC scheme error

[amyers16]

I'm using Splunk 8.1.0 on CentOS 7 and TA-dmarc 3.2.1. When the app loads, I get the following error: 

Unable to initialize modular input "dmarc_pop3" defined in the app "TA-dmarc": Introspecting scheme=dmarc_pop3: script running failed (exited with code 1)

Not sure what to make of it or how to even start troubleshooting.

Thanks,
Aaron 

[jorritf]

Just a quick note for other who might land here via Google: this issue was fixed in 3.2.3.

From the changelog (nov. 26, 2020):

• Added support for Splunk 8.1. (Thanks to Aaron Myers for reporting the issue)
• Fixed exception when using add-on together with listenOnIPv6=yes (Thanks to gryphius for reporting this issue)
• Fixed Gmail POP3 issue

[jorritf]

If there are still issues like these on 3.2.4, I suggest to:

• clear out the TA-dmarc/local/ directory (which resets the config back to default)
• if that doesn't work: remove the entire add-on from the heavy forwarder and reinstall

This seems to solve a number of reports where there were still Python2/3 related issues resulting in TA-dmarc: Introspecting scheme=<something> : script running failed (exited with code 1).

I haven't been able to reproduce any of these weird errors. A clean install on any Splunk version Just Works. I also tested some upgrade scenarios but haven't been able to find any issues there either. So I can't offer any direct solution, except for the "delete and reinstall" workaround above.

[wstarowicz]

Hi @jorritf 

I have it working on Splunk 8.1, but fails when setting Python 3 as default (please see logs below). After switching to Python 2 it works fine.

[amyers16]

Hi @alemarzu and thanks for the reply. I am on 8.1.0 and checked the [general] stanza. Python version wasn't defined so I added it and restarted. Unfortunately still the same issue. I reached out to the dev via email and they said they'd look into it.

[alemarzu]

Hi @amyers16 

There must be a python version compatibility issue, read the docs from the app and make sure is compatible with your Splunk version. Also, if you are running Splunk v8.x, check which python version is enabled on your $SPLUNK_HOME/etc/system/local/server.conf under the [general] stanza.

Like this

[general]
serverName = hostname
python.version = python3

[wstarowicz]

Have the same problem on Splunk 8.1.1. For now (because it is still possible) I forced globally on host downloading these data to use python2 and it works. So it seems as some incompatibility with python 3?

@jorritfany ideas on that? Below errors received:

	25/01/2021
14:34:27.069	
01-25-2021 14:34:27.069 +0100 ERROR ModularInputs - Unable to initialize modular input "dmarc_imap" defined in the app "TA-dmarc": Introspecting scheme=dmarc_imap: script running failed (exited with code 1)..

	25/01/2021
14:34:27.069	
01-25-2021 14:34:27.069 +0100 ERROR ModularInputs - Introspecting scheme=dmarc_imap: script running failed (exited with code 1).

	25/01/2021
14:34:27.069	
01-25-2021 14:34:27.069 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap:  ImportError: This package should not be accessible on Python 3. Either you are trying to run from the python-future src folder or your installation of python-future is corrupted.

	25/01/2021
14:34:27.069	
01-25-2021 14:34:27.069 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap:      raise ImportError('This package should not be accessible on Python 3. '

	25/01/2021
14:34:27.069	
01-25-2021 14:34:27.069 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap:    File "/opt/splunk/etc/apps/TA-dmarc/bin/copyreg/__init__.py", line 7, in <module>

	25/01/2021
14:34:27.068	
01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap:      import copyreg

	25/01/2021
14:34:27.068	
01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap:    File "/opt/splunk/lib/python3.7/re.py", line 321, in <module>

	25/01/2021
14:34:27.068	
01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap:      import re

	25/01/2021
14:34:27.068	
01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap:    File "/opt/splunk/etc/apps/TA-dmarc/bin/ta_dmarc_declare.py", line 10, in <module>

	25/01/2021
14:34:27.068	
01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap:      import ta_dmarc_declare

	25/01/2021
14:34:27.068	
01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap:    File "/opt/splunk/etc/apps/TA-dmarc/bin/dmarc_imap.py", line 1, in <module>

	25/01/2021
14:34:27.068	
01-25-2021 14:34:27.068 +0100 ERROR ModularInputs - <stderr> Introspecting scheme=dmarc_imap:  Traceback (most recent call last):