Deployment Architecture

After upgrade to 6.2.1 from 6.1.5, why am I getting error "Could not write to auth token file" trying to run: splunk reload deploy-server?

stemo76
Explorer

Upgraded from 6.1.5 to 6.2.1 and now when I attempt to run splunk reload deploy-server I get this error message

D:\Splunk\bin>splunk reload deploy-server
Splunk username: <userid>
Password:
Could not write to auth token file '\\<server>\users\.splunk\authToken_<localservernamer>_8089'.

An unforeseen error occurred:

        Exception: <type 'exceptions.WindowsError'>, Value: [Error 2] The system cannot find the file specified: '\\\\<server>\\users\\.splunk\\authToken_<localservernamer>_8089'

Traceback (most recent call last):
  File "D:\splunk\Python-2.7\Lib\site-packages\splunk\clilib\cli.py", line 1145, in main
    parseAndRun(argsList)
  File "D:\splunk\Python-2.7\Lib\site-packages\splunk\clilib\cli.py", line 872, in parseAndRun
    login({}, True)
  File "D:\splunk\Python-2.7\Lib\site-packages\splunk\clilib\cli.py", line 213, in login
    authToken = user_friendly_login(username, password, save=True)
  File "D:\splunk\Python-2.7\Lib\site-packages\splunk\clilib\cli.py", line 160, in user_friendly_login
    os.unlink(getAuthFilePath())
WindowsError: [Error 2] The system cannot find the file specified: '\\\\<server>\\users\\.splunk\\authToken_<localservernamer>_8089'


Please file a case online at http://www.splunk.com/page/submit_issue
1 Solution

stemo76
Explorer

Splunk found the cause. The newer version of python bundled with this version of splunk handled our environmental variables differently.

"I think we’re finally to the bottom of it. Splunk 6.x is packaged with a newer version of Python that handles Windows UNC paths differently. Before, building the file path with “\” would take you to the root of the file system or just “\”. Now Python recognizes that a path starting with “\” is a UNC path and so when you build the file path with “\” at the end it takes you to the root of the UNC mount which it expects to be at "\\”. That explains the difference."

The fix for use was this edit
In $SPLUNK_HOME\Python-2.7\Lib\site-packages\splunk\clilib\cli.py on line 1070 there is the following piece of code:

  userHome = os.path.join(userHomePrefix, userHome)

Change it to the following and your .splunk directory

  userHome = os.path.join(userHomePrefix, userHome.strip("\\"))

View solution in original post

stemo76
Explorer

Splunk found the cause. The newer version of python bundled with this version of splunk handled our environmental variables differently.

"I think we’re finally to the bottom of it. Splunk 6.x is packaged with a newer version of Python that handles Windows UNC paths differently. Before, building the file path with “\” would take you to the root of the file system or just “\”. Now Python recognizes that a path starting with “\” is a UNC path and so when you build the file path with “\” at the end it takes you to the root of the UNC mount which it expects to be at "\\”. That explains the difference."

The fix for use was this edit
In $SPLUNK_HOME\Python-2.7\Lib\site-packages\splunk\clilib\cli.py on line 1070 there is the following piece of code:

  userHome = os.path.join(userHomePrefix, userHome)

Change it to the following and your .splunk directory

  userHome = os.path.join(userHomePrefix, userHome.strip("\\"))

matthieu_araman
Communicator

Hello,

the error message may come a splunk command (with authentication ) which was launched from another user (automatically or manually) which wrote the file with another rights on it.
Is the file \\users.splunk\authToken__8089 existing ?
if this is the case, what if you rename it to .old and try again your command ?
can you create a file and later modify it in the same directory ( \\users.splunk) while logged with the same windows user (from a command line for example) ?
As a workaround, you could also try with a local home directory configured for your windows user by I guess this is not what you want to do.(there may be a pb with the way splunk uses the remote path. in 6.2..)

Hope that helps

0 Karma

stemo76
Explorer

This seems to be capturing the homepath of the user signed \\users\ but the .splunk\authToken__8089 file is in the root of 😧

0 Karma

stemo76
Explorer

I have opened a ticket with Splunk support but still no resolution.

0 Karma

sbrice36
Explorer

After your 6.2.1 upgrade, did you have any issues with saved searches or saved alerts? It looks like I lost mine after the 6.2 upgrade.

0 Karma

stemo76
Explorer

We have had that problem before, we had saved searches and alerts within the app folder. The deployment server wiped out that data and re-wrote those directories from its source.

We copied those items to our deployment server so that it could be replicated out with the app.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...