All Apps and Add-ons

Template for Citrix XenApp error from GetXAApplicationReport6x.ps1 every time - all servers

brooklynotss
Path Finder

We've deployed this app to all our XenApp Servers (~20 Win 2008 R2, XenApp 6.5, Splunk 6.2) - everything working great except this error showing up for all servers constantly, from this script: GetXAApplicationReport6x.ps1 - I believe line 42 char:34. Hard to tell because the error string is split into multiple events in the index but I think the full error is:

Split-Path : Cannot bind argument to parameter 'Path' because it is an empty string.
At C:/Program Files/SplunkUniversalForwarder/etc/apps/TA-XA6x-ZDC/bin/powershell/GetXAApplicationReport6x.ps1:42 char:34
+ $ProcessName = Split-Path <<<< $c[0] -Leaf
+ CategoryInfo : InvalidData: (:) [Split-Path], ParameterBindingValidationException
+ FullyQualifiedErrorId : > ParameterArgumentValidationErrorEmptyStringNotAllowed,Microsoft.PowerShell.Commands.SplitPathCommand

I suspect it's benign as I believe all our dashboards are populating but would be nice to clean this up if possible.

0 Karma

splunk_pn
Explorer

This is probably because you have published desktops - which do not have any "CommandLine".

So you could change the Get-XAApplicationReport line:

foreach( $Application in (Get-XAApplicationReport * ) ) {

to:

foreach( $Application in (Get-XAApplicationReport * | where-object {$_.ApplicationType -ne "ServerDesktop"}) ) {

Then it will not check those published "app".,This is probably because you have published desktops - which do not have any "CommandLine".

So you could change the Get-XAApplicationReport line:

foreach( $Application in (Get-XAApplicationReport * ) ) {

to:

foreach( $Application in (Get-XAApplicationReport * | where-object {$_.ApplicationType -ne "ServerDesktop"}) ) {

Then it will not check those published "app".

nicolay_koecher
Explorer

Hello jconger,

I Installed the Splunk XenApp template 1.1.1on my Linux box. And the following error in splunkd.log is displayed:

07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + ~~~~~~~~~~~~~~~~~~~~~~~~~~
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + CategoryInfo : InvalidData: (:) [Split-Path], ParameterBindingV
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" alidationException
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAl
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" lowed,Microsoft.PowerShell.Commands.SplitPathCommand

What can I do to solve this issue.

The next Thing is not all Perf is displayed (e.g. Memory Metrics, System Metrics and Disk Metrics are empty. CPU, Page file and Network metrics are shown.

Thanks for your support

Cheers Nicolay

0 Karma

jconger
Splunk Employee
Splunk Employee

Did you update the TA-XA6x-ZDC on your Zone Data Collector? The PowerShell script in that TA was changed to fix the original issue.

0 Karma

nicolay_koecher
Explorer

Hello,

yes I did that - just do be sure I copied the folder again. Got still the same Error:

copied:template-for-citrix-xenapp_111
on my zdc its also xml broker
- TA-XA6x-XML
--TA-XA6x-ZDC
on my worker
TA-XA6x-Server

07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" At C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershel
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" l\GetXAApplicationReport6x.ps1:26 char:42
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + $ProcessName = (Split-Path -leaf ( $c[0] -replace '"','' ))
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" -replace ". ...
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + ~~~~~~~~~~~~~~~~~~~~~~~~~~
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + CategoryInfo : InvalidData: (:) [Split-Path], ParameterBindingV
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" alidationException
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAl
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" lowed,Microsoft.PowerShell.Commands.SplitPathCommand
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd"

07-17-2015 10:00:49.024 +0200 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.244.224.81_8089_s0101954.de.db.com_S0101954_32D414DA-67CA-42A2-AFA2-4F581659353C
07-17-2015 10:00:49.026 +0200 INFO DC:HandshakeReplyHandler - Handshake done.

0 Karma

nicolay_koecher
Explorer

Hello,
any suggestions? - still have the same Issue.

07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" l\GetXAApplicationReport6x.ps1:26 char:42
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + $ProcessName = (Split-Path -leaf ( $c[0] -replace '"','' ))
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" -replace ". ...
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + ~~~~~~~~~~~~~~~~~~~~~~~~~~
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + CategoryInfo : InvalidData: (:) [Split-Path], ParameterBindingV
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" alidationException
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAl
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" lowed,Microsoft.PowerShell.Commands.SplitPathCommand
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd"

cheers Nicolay

0 Karma

jconger
Splunk Employee
Splunk Employee

Looks like I need to add some more error checking to the script. For the most part, that error is indeed benign.

What is going on here is the script is trying to split out the command line executable on the published application to get only the executable name. For instance, if you have a command line executable like so:

c:\Program Files\foo\bar.exe

The script tries to get just "bar.exe" as the process name. The reason for this is there are some correlation dashboards that tie together information from perfmon to published applications. Perfmon only has the executable - not the published application name.

The script is written in such a way that this error will not stop the processing. Therefore, it is only not getting the $ProcessName for the published application causing the error. All the other information will be collected. So - yeah, kind of benign, but I'll get some better error checking in there.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...