ERROR ExecProcessor [ ExecProcessor] - message from "/opt/splunk/etc/apps/onepassword_events_api/bin/signin_attempt

[raz_gp]

Statement: You install  1Password Events Reporting for Splunk from   https://splunkbase.splunk.com/app/5632 

Problem: You get error messages after correctly configuring it in the _internal index like: 

03-26-2024 11:37:30.974 +0000 ERROR ExecProcessor [12044 ExecProcessor] - message from "/opt/splunk/etc/apps/onepassword_events_api/bin/audit_events" 2024/03/26 11:37:30 [DEBUG] POST https://events.1password.com/api/v1/auditevents
03-26-2024 11:37:27.672 +0000 ERROR ExecProcessor [12044 ExecProcessor] - message from "/opt/splunk/etc/apps/onepassword_events_api/bin/signin_attempts" 2024/03/26 11:37:27 [DEBUG] POST https://events.1password.com/api/v1/signinattempts
03-26-2024 11:37:23.259 +0000 ERROR ExecProcessor [12044 ExecProcessor] - message from "/opt/splunk/etc/apps/onepassword_events_api/bin/item_usages" 2024/03/26 11:37:23 [DEBUG] POST https://events.1password.com/api/v1/itemusages
03-26-2024 11:37:20.561 +0000 ERROR ExecProcessor [12044 ExecProcessor] - message from "/opt/splunk/etc/apps/onepassword_events_api/bin/audit_events" 2024/03/26 11:37:20 [DEBUG] POST https://events.1password.com/api/v1/auditevents
03-26-2024 11:37:17.440 +0000 ERROR ExecProcessor [12044 ExecProcessor] - message from "/opt/splunk/etc/apps/onepassword_events_api/bin/signin_attempts" 2024/03/26 11:37:17 [DEBUG] POST https://events.1password.com/api/v1/signinattempts

How do you resolve this?
The app was configured with a token, macros had indexes defined, interval for the scripted input set to a cron schedule. 

Splunk 9.0.3 core standalone dev env. 

[marnall]

I've seen this too. Despite these 1Password logs being labeled as "ERROR", they then show debug messages that only say the app made a POST request to the 1Password endpoint. 

This looks like a case of the 1Password app developers mistakenly putting DEBUG messages into the ERROR log function. It can be ignored and the developers can be requested to ensure that the DEBUG messages are logged at the DEBUG level.

[raz_gp]

Response received form support: 

This issue is currently being raised with our internal teams to look into changing the behavior of these checks in a future release of the app to avoid this error from appearing in the logs.

Looking at the options available in Splunk regarding the application, there does not seem to be a way to limit the polling frequency, that in turn would reduce the number of errors appearing.