Splunk UF: getting error ERROR ExecProcessor

[teddyidc1101]

Hi - I saw these errors in SPlunkd.log. our UF is currenlty down and cannot be restarted. I'm not sure if these errors impacts the UF itself but what does it mean if i get these errors in UF splunkd.log? will this cause the UF to be down?

UF was down 30mins after these errors.

05-21-2018 00:01:42.952 +0000 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/_apps_inputs/bin/service.sh" Note: This output shows SysV services only and does not include native
05-21-2018 00:01:42.952 +0000 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/_apps_inputs/bin/service.sh"       systemd services. SysV configuration data might be overridden by native
05-21-2018 00:01:42.952 +0000 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/_apps_inputs/bin/service.sh"       systemd configuration.
05-21-2018 00:01:42.952 +0000 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/_apps_inputs/bin/service.sh"       If you want to list systemd services use 'systemctl list-unit-files'.
05-21-2018 00:01:42.952 +0000 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/_apps_inputs/bin/service.sh"       To see services enabled on particular target use
05-21-2018 00:01:42.952 +0000 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/_apps_inputs/bin/service.sh"       'systemctl list-dependencies [target]'.

[xpac]

Hey,

I re-formatted your question so the error messages become more readable. You can do so yourself in the future by selecting the text in the input box and clicking the little 101010 button above.

The errors you see come from the ExecProcessor, which is responsible for running scripted inputs and the like. Errors from that processor shouldn't cause the UF to go down - it's simple output from the script /opt/splunkforwarder/etc/apps/_apps_inputs/bin/service.sh that arrives via the so called standard error channel (stderr), and usually contains errors and warnings.

As this seems to be from a non-default app (_apps_inputs) you would have to check with the author of that app/script to see why it causes these messages. However, in this case, it's not an actual error, more of a warning/information.

What do you mean by your UF being down? It's actually not running, e.g. splunk status shows it's not running? It's not visible via the Forwarder Management tab on the Deployment server?

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂