Security

Cisco IPS Python Error

darthsplunk
Explorer

Hi,

I'm wondering if anyone could help - seem to be getting into real trouble with Cisco IPS feeds. I have the Splunk add-on for Cisco IPS 2.11 installed on my Search Head, two Indexers and a Heavy Forwarder. As per the configuration guide, no configuration has been performed within the app on the search head or indexers. I have set the app up via the GUI on the heavy forwarder entering the host, username, password and interval (default value of 15).

I am seeing lots of erros from python in splunkd.log on the heavy forwarder, such as:

12-10-2014 17:22:55.390 +0000 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco-ips\bin\get_ips_feed.py" 10.1.1.50 15" IOError: [Errno 2] No such file or directory: 'C:\\Program Files\\Splunk\\etc\\apps\\Splunk_TA_cisco-ips\\var\\log\\ips_sdee.log.10.1.1.50'

12-10-2014 17:22:55.390 +0000 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco-ips\bin\get_ips_feed.py" 10.1.1.50 15"     stream = open(self.baseFilename, self.mode)

12-10-2014 17:22:55.390 +0000 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco-ips\bin\get_ips_feed.py" 10.1.1.50 15"   File "C:\Program Files\Splunk\Python-2.7\Lib\logging\__init__.py", line 925, in _open

12-10-2014 17:22:55.390 +0000 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco-ips\bin\get_ips_feed.py" 10.1.1.50 15"     StreamHandler.__init__(self, self._open())

I would paste more errors, but after the first line they don't appear to be useful. This is happening at each interval (which in the inputs.conf seems to be every second).

It is also very strange that there is only one entry in sdee_connection.log:

Wed Dec 10 16:52:21 2014 - Could not get IPS 10.1.1.50 credentials from splunk: ResponseNotReady

I have checked and the credentials are valid for the IPS that Splunk is connecting to.

Why is the app not able to create a log file ips_sdee.log.10.1.1.50?

Any help is apreciated as I don't know how to troubleshoot from here...

Thanks,
DS

Tags (1)
0 Karma

jmallorquin
Builder

Try to use a versión of splunk before 6.

Its looks like there is a problem with the phyton version includen in versión 6.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...