All Apps and Add-ons

enCore 4.0.9 for Splunk 8.1.0.1

newbie2020
Observer

I have configured the FMC and encore , on running the test from Splunk CLI using .splencore.sh test , it is successful.

On checking the Search and Reporting for "sourcetype="cisco:estreamer:log" , i see these exceptions. How can i fix this ? Currently we are not seeing the events sent from FMC .

2020-12-16 13:04:09,058 Service      ERROR    [no message or attrs]: 'EncoreException' object has no attribute 'message'\n'EncoreException' object has no attribute 'message'Traceback (most recent call last):\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/diagnostics.py", line 61, in execute\n    estreamer.Crypto.create( settings = self.settings )\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/crypto.py", line 104, in create\n    settings.publicKeyFilepath())\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/crypto.py", line 33, in __init__\n    privateKeyFilepath ))\nestreamer.exception.EncoreException: privateKeyFilepath: /root/splunk/etc/apps/TA-eStreamer/bin/encore/192.168.0.100-8302_pkcs.key does not exist or is not a file\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "/root/splunk/lib/python3.7/getpass.py", line 69, in unix_getpass\n    old = termios.tcgetattr(fd)     # a copy to save\ntermios.error: (25, 'Inappropriate ioctl for device')\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/diagnostics.py", line 70, in execute\n    password = getpass.getpass( prompt = definitions.STRING_PASSWORD_PROMPT )\n  File "/root/splunk/lib/python3.7/getpass.py", line 91, in unix_getpass\n    passwd = fallback_getpass(prompt, stream)\n  File "/root/splunk/lib/python3.7/getpass.py", line 126, in fallback_getpass\n    return _raw_input(prompt, stream)\n  File "/root/splunk/lib/python3.7/getpass.py", line 148, in _raw_input\n    raise EOFError\nEOFError\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/controller.py", line 247, in start\n    diagnostics.execute()\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/diagnostics.py", line 73, in execute\n    raise estreamer.EncoreException( definitions.STRING_PASSWORD_STDIN_EOF )\nestreamer.exception.EncoreException: Unable to read password from console. Are you running as a background process? Try running in test or foreground mode\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "./estreamer/service.py", line 181, in main\n    self.start( reprocessPkcs12 = args.pkcs12 )\n  File "./estreamer/service.py", line 150, in start\n    self._posix()\n  File "./estreamer/service.py", line 92, in _posix\n    self._loop()\n  File "./estreamer/service.py", line 59, in _loop\n    self.client.start()\n  File "/root/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/controller.py", line 255, in start\n    'description': ex.message\nAttributeError: 'EncoreException' object has no attribute 'message'\n

 

Labels (1)
0 Karma

newbie2020
Observer

Even though the  ./splencore.sh test   shows successful,
Please Enter the FMC IP: x.x.x.x
906 Diagnostics INFO Connection successful

/opt/splunk/etc/apps/TA-eStreamer/bin/splencore.sh status
status_id=0 status="Stopped"

tried restarting the splunk ,   ./splunk restart  and then check the splencore.sh status , it is still stopped

0 Karma

scottbrion
Loves-to-Learn

Have you found a resolution? Having the same issue

0 Karma

DanielPi
Moderator
Moderator

Hi @scottbrion   -

I’m a Community Moderator in the Splunk Community. 
This question was posted 3 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post.

Thank you! 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...