Error after upgrading to version 7.1.1.

[MAMAOUI]

Hi All,

Every minute I receive the error:

msg="A script exited abnormally" input="./bin/instrumentation.py" stanza="default" status="exited with code 114"

I get this error after upgrading to Splunk 7.1.1.

Thanks
M&A

[Tony_chan]

We also had the same problem, but we can't find the instrumentation.py folder, and there has nothing in input.conf.
Where can we find more information about this issue.

[jamesjarrett · Accepted solution]

Check SOLNESS-15251, at SplunkES fixed issues.

The answer was posted by @donaldmurchison :

I recently had this issue on an instance with ES as well. We traced it back to the “[configuration_check://confcheck_script_errors]” stanza in inputs.conf of the ES app. It looks like this stanza was not in ES version 5.0.1.

We decided to just add instrumentation.py to the regex in the suppress setting of this stanza. The error is still included in the internal logs but doesn’t show up as a bulletin message anymore.
....

Yes, this is just a workaround. However, ‘msg="A script exited abnormally" input="$SPLUNK_HOME/etc/apps/splunk_instrumentation/bin/instrumentation.py" stanza="default" status="exited with code 114"’, does not indicate an actual issue. If that's what you are receiving, suppressing the message should be fine for now. From the Enterprise Security fixed issues page (SOLNESS-15251), http://docs.splunk.com/Documentation/ES/5.1.0/RN/FixedIssues, “Exit code 114 is normal for instrumentation.py and should be whitelisted”. If you are receiving a different exit code, you might have a bigger problem.

[dpurtell]

For clarification, I understand the exit code 114 is normal, but can these be suppressed from displaying in Messages? Is there an update planned to remove from showing in Messages? Thank you- Duane

[ejenson_splunk]

As an FYI. This issue appears to be back in ES 5.2.2 at a minimum. I have not checked versions between 5.1.0 where the issue was supposedly fixed and 5.2.2.

[jamesjarrett]

I too am having this issue with my SplunkES instance. Of course, it is highly underpowered but still suffering this issue after upgrading to 7.1.1

Other instances are not having this issue. All are Azure VMs

[donaldmurchison]

I recently had this issue on an instance with ES as well. We traced it back to the “[configuration_check://confcheck_script_errors]” stanza in inputs.conf of the ES app. It looks like this stanza was not in ES version 5.0.1.

We decided to just add instrumentation.py to the regex in the suppress setting of this stanza. The error is still included in the internal logs but doesn’t show up as a bulletin message anymore.

[MAMAOUI]

Hello,
Thanks Donald, I added instrumentation script in the suppress stanza “[configuration_check://confcheck_script_errors]” in local and it worked , i don't see message error anymore.

[jamesjarrett]

While it may get rid of the problem showing up in the the messages, it still doesn't address whatever this issue is. I would have figured that someone would have a much better answer by now - especially since its related to Enterprise Security :-(.

[donaldmurchison]

Yes, this is just a workaround. However, ‘msg="A script exited abnormally" input="$SPLUNK_HOME/etc/apps/splunk_instrumentation/bin/instrumentation.py" stanza="default" status="exited with code 114"’, does not indicate an actual issue. If that's what you are receiving, suppressing the message should be fine for now. From the Enterprise Security fixed issues page (SOLNESS-15251), http://docs.splunk.com/Documentation/ES/5.1.0/RN/FixedIssues, “Exit code 114 is normal for instrumentation.py and should be whitelisted”. If you are receiving a different exit code, you might have a bigger problem.

[renjith_nair]

Hi @MAMAOUI,

Check your inputs.conf where you have a script scheduled /bin/instrumentation.py and try to identify the issue with the script.

[stmyers84]

I'm also getting this error, and have disabled the scripted input in inputs.conf....still getting error.

[MAMAOUI]

I have the same probleme,I verified the input.conf ... and still getting same message error, did you find any solution?Thanks