splunk-winprintmon.exe splunk-winPrintMon - monitorHost::ProcessRefresh: Failed ProcessRefresh: error = '0x800706ba'.

[edoardo_vicendo]

Hello,

We have around 10K events per hour on _internal index from a Splunk UF 9.1.2 installed on a Windows 10 22H2 machine (build 19045.3930).

I know the problem is that the Printer service is disabled, the question is why Splunk UF is not trying to check WinPrintMon every 600 seconds as per inputs.conf

Here seems the reason, why is ignoring the interval parameter?

03-14-2024 11:02:02.900 +0100 INFO ExecProcessor [4212 ExecProcessor] - Ignoring parameter "interval" for modular input "WinPrintMon" when scheduling the runtime for script=""C:\Program Files\SplunkUniversalForwarder\bin\scripts\splunk-winprintmon.path"". This means potentially Splunk won't be restarting it in case it gets terminated.

Here the logs in _internal index (around 180 per minutes, so 3 times per second)

03-14-2024 10:30:23.470 +0100 ERROR ExecProcessor [7088 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"" splunk-winPrintMon - monitorHost::ProcessRefresh: Failed ProcessRefresh: error = '0x800706ba'. Restart.
03-14-2024 10:30:23.470 +0100 ERROR ExecProcessor [7088 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"" splunk-winPrintMon - monitorHost::ProcessRefresh: Failed ProcessRefresh: error = '0x800706ba'. Restart.
03-14-2024 10:30:22.932 +0100 ERROR ExecProcessor [7088 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"" splunk-winPrintMon - monitorHost::ProcessRefresh: Failed ProcessRefresh: error = '0x800706ba'. Restart.
03-14-2024 10:30:22.707 +0100 ERROR ExecProcessor [7088 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"" splunk-winPrintMon - monitorHost::ProcessRefresh: Failed ProcessRefresh: error = '0x800706ba'. Restart.
03-14-2024 10:30:22.407 +0100 ERROR ExecProcessor [7088 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"" splunk-winPrintMon - monitorHost::ProcessRefresh: Failed ProcessRefresh: error = '0x800706ba'. Restart.

Here inputs.conf

###### Print monitoring ######
[WinPrintMon://printer]
type = printer
interval = 600
baseline = 1
disabled = 0
index=idx_xxxx_windows

[WinPrintMon://job]
type = job
interval = 600
baseline = 1
disabled = 0
index=idx_xxxx_windows

[WinPrintMon://driver]
type = driver
interval = 600
baseline = 1
disabled = 0
index=idx_xxxx_windows

[WinPrintMon://port]
type = port
interval = 600
baseline = 1
disabled = 0
index=idx_xxxx_windows

Thanks a lot,
Edaordo

[edoardo_vicendo · Accepted solution]

Here below the reply from Splunk support that contacted the Development team:

Please find the detailed explanation for the issue and the solution:

The logs and your inputs.conf excerpt indicate that the Splunk Universal Forwarder (UF) is indeed ignoring the interval parameter specified for the WinPrintMon modular input. This is explicitly stated in the log message:

> Ignoring parameter "interval" for modular input "WinPrintMon" when scheduling the runtime for script

Why is this happening?

The reason behind this behavior lies in how Splunk UF handles script-based modular inputs and their failures.

Script Failures and Retries: When the splunk-winprintmon script fails (in this case, due to the disabled Printer service), Splunk UF doesn't wait for the configured interval to retry. Instead, it attempts to restart the script almost immediately. This rapid retry mechanism is likely designed to ensure quick recovery from transient errors. 

Interval Adherence on Success: The interval parameter is only respected when the script completes successfully. In other words, if the splunk-winprintmon script runs without errors, Splunk UF will wait for the specified 600 seconds before executing it again.The combination of script failures and the ignored interval leads to the observed high frequency of error messages in the _internal index (3 times per second). This can potentially overwhelm the Splunk indexer and impact overall system performance.

Solution:

 Fix the Script Failure: The primary issue is the disabled Printer service causing the splunk-winprintmon script to fail.

   * Enable the Printer service if print monitoring is required.

   * Disable the WinPrintMon input in inputs.conf if print monitoring is not needed.

Splunk UF's behavior of ignoring the interval parameter for failing script-based modular inputs is by design.

It prioritizes quick recovery from errors over strict adherence to the configured polling interval.

Understanding this behavior is crucial for troubleshooting and optimizing Splunk UF deployments, especially when dealing with inputs that might experience frequent failures.

The error 0x800706ba indicates that the "RPC server is unavailable," which is due to the Printer service being disabled.