enCore 4.0.9 for Splunk 8.1.0.1

[newbie2020]

I have configured the FMC and encore , on running the test from Splunk CLI using .splencore.sh test , it is successful.

On checking the Search and Reporting for "sourcetype="cisco:estreamer:log" , i see these exceptions. How can i fix this ? Currently we are not seeing the events sent from FMC .

2020-12-16 13:04:09,058 Service      ERROR    [no message or attrs]: 'EncoreException' object has no attribute 'message'\n'EncoreException' object has no attribute 'message'Traceback (most recent call last):\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/diagnostics.py", line 61, in execute\n    estreamer.Crypto.create( settings = self.settings )\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/crypto.py", line 104, in create\n    settings.publicKeyFilepath())\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/crypto.py", line 33, in __init__\n    privateKeyFilepath ))\nestreamer.exception.EncoreException: privateKeyFilepath: /root/splunk/etc/apps/TA-eStreamer/bin/encore/192.168.0.100-8302_pkcs.key does not exist or is not a file\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "/root/splunk/lib/python3.7/getpass.py", line 69, in unix_getpass\n    old = termios.tcgetattr(fd)     # a copy to save\ntermios.error: (25, 'Inappropriate ioctl for device')\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/diagnostics.py", line 70, in execute\n    password = getpass.getpass( prompt = definitions.STRING_PASSWORD_PROMPT )\n  File "/root/splunk/lib/python3.7/getpass.py", line 91, in unix_getpass\n    passwd = fallback_getpass(prompt, stream)\n  File "/root/splunk/lib/python3.7/getpass.py", line 126, in fallback_getpass\n    return _raw_input(prompt, stream)\n  File "/root/splunk/lib/python3.7/getpass.py", line 148, in _raw_input\n    raise EOFError\nEOFError\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/controller.py", line 247, in start\n    diagnostics.execute()\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/diagnostics.py", line 73, in execute\n    raise estreamer.EncoreException( definitions.STRING_PASSWORD_STDIN_EOF )\nestreamer.exception.EncoreException: Unable to read password from console. Are you running as a background process? Try running in test or foreground mode\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "./estreamer/service.py", line 181, in main\n    self.start( reprocessPkcs12 = args.pkcs12 )\n  File "./estreamer/service.py", line 150, in start\n    self._posix()\n  File "./estreamer/service.py", line 92, in _posix\n    self._loop()\n  File "./estreamer/service.py", line 59, in _loop\n    self.client.start()\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/controller.py", line 255, in start\n    'description': ex.message\nAttributeError: 'EncoreException' object has no attribute 'message'\n

[newbie2020]

Even though the  ./splencore.sh test   shows successful,
Please Enter the FMC IP: x.x.x.x
906 Diagnostics INFO Connection successful

/opt/splunk/etc/apps/TA-eStreamer/bin/splencore.sh status
status_id=0 status="Stopped"

tried restarting the splunk ,   ./splunk restart  and then check the splencore.sh status , it is still stopped

[scottbrion]

Have you found a resolution? Having the same issue

[DanielPi]

Hi @scottbrion   -

I’m a Community Moderator in the Splunk Community. 
This question was posted 3 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post.

Thank you!