We are receinving the error below in our environment after deploying the Splunk Add-on for Microsoft Windows:
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - configure: no drive specifier found: '$windir\system32\dns\dns.log'
The target systems are running Windows Server 2012 R2 Standard, and the universal forwarder is running as the local system account.
Splunk Component Versions:
Splunk Enterprise 8.0.1
Splunk Universal Forwarder 7.3.4
Splunk Add-on for Microsoft Windows 7.0.0
Any guidance on troubleshooting this would be greatly appreciated.
Sorry for the delay, I wanted to run the updated configuration for long enough to validate the change.
Updating the input from "MonitorNoHandle://$WINDIR\System32\Dns\dns.log" to "MonitorNoHandle://C:\Windows\System32\Dns\dns.log" does indeed resolve the issue. What's really odd though is the $WINDIR variable seems to be working in other inputs. For example, "monitor://$WINDIR\WindowsUpdate.log" being enabled does not generate the error.
My guess is that the issue is something specific to the resolution of environment variables by the MonitorNoHandle process. While all of our systems do have C: for the OS drive, it would be more ideal to use the environment variable to protect against edge cases. Is there any thing else we can do to troubleshoot further, or is it time for a bug report?
We have not. I'll get that and updating the Windows Server 2012 forwarders to 7.3.5 onto our patching schedule to see if either resolves the issue. Given that will not be a swift process due to some bureaucracy, would it be best to mark this question as resolved with removing the environmental variable as a work around solution?
I would try to test it on at least one test server and see if it resolves the problem. I don't see anything in the release notes about it fixing an issue with the monitor-nohandle but that doesn't necessarily mean anything.
The quickest thing to do is to open a support case with the information and see if they are aware of the issue. It definitely sounds like a bug.