Getting Data In

Why is cmd script not running?

pbnl
Path Finder

hi all,

i try to run a cmd script on a UF.  it's located in %SPLUNK_HOME%\etc\apps\log4jscan\bin\log4jscan.cmd and the content is
..\static\log4j2-scan.exe --all-drives --scan-log4j1 --scan-logback --csv-log-path "%SPLUNK_HOME%\var\log\log4jscan" 

the inputs.conf is in %SPLUNK_HOME%\etc\apps\log4jscan\default and looks like this: (interval will be changed to run once per month)
[script://..\bin\log4jscan.cmd]
disabled = False
interval = 600

i added> debug.txt 2>&1 to the script, but no file is created.
any ideas?

thanks...

Labels (2)
0 Karma
1 Solution

pbnl
Path Finder

after finding out that i have to change execprocessor logging mode to DEBUG, it shows, that the problem was with the path. after struggling around with that, i ended up with this:

inputs.conf
[script://$SPLUNK_HOME/etc/apps/PBNL_log4jscanWIN/bin/log4jscan.cmd]
disabled = False
interval = 15 0 1 * *
[monitor://C:\Program Files\SplunkUniversalForwarder\var\log\log4jscan.log]
disabled = false
sourcetype = log4jscan

log4jscan.cmd
"%SPLUNK_HOME%\etc\apps\PBNL_log4jscanWIN\static\log4j2-scan.exe" --all-drives --scan-log4j1 --scan-logback --csv-log-path "%SPLUNK_HOME%\var\log\log4jscan.log"

as you can see, it's a windows/linux mix of notation styles, where the monitor clause does'nt resolve variables.
from other posts i assuemed, the "base path" for an app is in my case %SPLUNK_HOME%\etc\apps\PBNL_log4jscanWIN\. but that seems to be not the case.

anyway, learned some new stuff...

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Does the log4j2-scan command work if run manually?  Does Splunk have permission to run the command?  Have you checked the UF's logs for messages that might explain why the script doesn't run?

---
If this reply helps you, Karma would be appreciated.
0 Karma

pbnl
Path Finder

after finding out that i have to change execprocessor logging mode to DEBUG, it shows, that the problem was with the path. after struggling around with that, i ended up with this:

inputs.conf
[script://$SPLUNK_HOME/etc/apps/PBNL_log4jscanWIN/bin/log4jscan.cmd]
disabled = False
interval = 15 0 1 * *
[monitor://C:\Program Files\SplunkUniversalForwarder\var\log\log4jscan.log]
disabled = false
sourcetype = log4jscan

log4jscan.cmd
"%SPLUNK_HOME%\etc\apps\PBNL_log4jscanWIN\static\log4j2-scan.exe" --all-drives --scan-log4j1 --scan-logback --csv-log-path "%SPLUNK_HOME%\var\log\log4jscan.log"

as you can see, it's a windows/linux mix of notation styles, where the monitor clause does'nt resolve variables.
from other posts i assuemed, the "base path" for an app is in my case %SPLUNK_HOME%\etc\apps\PBNL_log4jscanWIN\. but that seems to be not the case.

anyway, learned some new stuff...

Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...