Deployment Architecture

After upgrade to 6.2.1 from 6.1.5, why am I getting error "Could not write to auth token file" trying to run: splunk reload deploy-server?

stemo76
Explorer

Upgraded from 6.1.5 to 6.2.1 and now when I attempt to run splunk reload deploy-server I get this error message

D:\Splunk\bin>splunk reload deploy-server
Splunk username: <userid>
Password:
Could not write to auth token file '\\<server>\users\.splunk\authToken_<localservernamer>_8089'.

An unforeseen error occurred:

        Exception: <type 'exceptions.WindowsError'>, Value: [Error 2] The system cannot find the file specified: '\\\\<server>\\users\\.splunk\\authToken_<localservernamer>_8089'

Traceback (most recent call last):
  File "D:\splunk\Python-2.7\Lib\site-packages\splunk\clilib\cli.py", line 1145, in main
    parseAndRun(argsList)
  File "D:\splunk\Python-2.7\Lib\site-packages\splunk\clilib\cli.py", line 872, in parseAndRun
    login({}, True)
  File "D:\splunk\Python-2.7\Lib\site-packages\splunk\clilib\cli.py", line 213, in login
    authToken = user_friendly_login(username, password, save=True)
  File "D:\splunk\Python-2.7\Lib\site-packages\splunk\clilib\cli.py", line 160, in user_friendly_login
    os.unlink(getAuthFilePath())
WindowsError: [Error 2] The system cannot find the file specified: '\\\\<server>\\users\\.splunk\\authToken_<localservernamer>_8089'


Please file a case online at http://www.splunk.com/page/submit_issue
1 Solution

stemo76
Explorer

Splunk found the cause. The newer version of python bundled with this version of splunk handled our environmental variables differently.

"I think we’re finally to the bottom of it. Splunk 6.x is packaged with a newer version of Python that handles Windows UNC paths differently. Before, building the file path with “\” would take you to the root of the file system or just “\”. Now Python recognizes that a path starting with “\” is a UNC path and so when you build the file path with “\” at the end it takes you to the root of the UNC mount which it expects to be at "\\”. That explains the difference."

The fix for use was this edit
In $SPLUNK_HOME\Python-2.7\Lib\site-packages\splunk\clilib\cli.py on line 1070 there is the following piece of code:

  userHome = os.path.join(userHomePrefix, userHome)

Change it to the following and your .splunk directory

  userHome = os.path.join(userHomePrefix, userHome.strip("\\"))

View solution in original post

stemo76
Explorer

Splunk found the cause. The newer version of python bundled with this version of splunk handled our environmental variables differently.

"I think we’re finally to the bottom of it. Splunk 6.x is packaged with a newer version of Python that handles Windows UNC paths differently. Before, building the file path with “\” would take you to the root of the file system or just “\”. Now Python recognizes that a path starting with “\” is a UNC path and so when you build the file path with “\” at the end it takes you to the root of the UNC mount which it expects to be at "\\”. That explains the difference."

The fix for use was this edit
In $SPLUNK_HOME\Python-2.7\Lib\site-packages\splunk\clilib\cli.py on line 1070 there is the following piece of code:

  userHome = os.path.join(userHomePrefix, userHome)

Change it to the following and your .splunk directory

  userHome = os.path.join(userHomePrefix, userHome.strip("\\"))

matthieu_araman
Communicator

Hello,

the error message may come a splunk command (with authentication ) which was launched from another user (automatically or manually) which wrote the file with another rights on it.
Is the file \\users.splunk\authToken__8089 existing ?
if this is the case, what if you rename it to .old and try again your command ?
can you create a file and later modify it in the same directory ( \\users.splunk) while logged with the same windows user (from a command line for example) ?
As a workaround, you could also try with a local home directory configured for your windows user by I guess this is not what you want to do.(there may be a pb with the way splunk uses the remote path. in 6.2..)

Hope that helps

0 Karma

stemo76
Explorer

This seems to be capturing the homepath of the user signed \\users\ but the .splunk\authToken__8089 file is in the root of 😧

0 Karma

stemo76
Explorer

I have opened a ticket with Splunk support but still no resolution.

0 Karma

sbrice36
Explorer

After your 6.2.1 upgrade, did you have any issues with saved searches or saved alerts? It looks like I lost mine after the 6.2 upgrade.

0 Karma

stemo76
Explorer

We have had that problem before, we had saved searches and alerts within the app folder. The deployment server wiped out that data and re-wrote those directories from its source.

We copied those items to our deployment server so that it could be replicated out with the app.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...