Installation

Error/warning message after upgrade from v7.2.1 to v.8.0.0

tlabue
Path Finder

I am seeing the following errors after an upgrade from v7.2.1 Enterprise to v.8.0.0 Enterprise:

First issue:
WARN LocalAppsAdminHandler - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf
Had not seen this before. We have not previously set enable_install_apps set to TRUE. I don't see any documentation that needs to be in place.

Second issue:
LMStackMgr - license_warnings_update_interval=auto has reached the minimum threshold 10. Will not reduce license_warnings_update_interval beyond this value
This is running Enterprise licenses on standalone server, not using a license master.

These messages occur every 20-30 seconds. Can't find any reference to the message and wonder what I can do to stop these messages from being generated.

Labels (2)

BserviR
Explorer

Thanks. Changing the 'enable_install_app=true' fixed the "Using deprecated capabilities for write errors".

0 Karma

tlabue
Path Finder

I have added a telemetry.conf (in etc/system/local) file with the following:
[general]
sendLicenseUsage = false
Though, this has not led to the license_warnings_update_interval_messages abating.

The Instrumentation Panel setting say that the License and Version Data sharing is automatically turned on, though the documentation for telemetry.conf doesn't seem to agree with that.

Also added these items:
In limits.conf:
[auth]
enable_install_apps = true

and in server.conf
[license]
license_warnings_update_interval = 60

Both seem to be new attributes. license_warnings_update_internal should default to 0, but I didn't see anything in the default server.conf file, so I set it to a value in the range (10, 3600).
enable_install_apps defaults to false, but generated the deprecated messages, so I changed the value to true.

Seems odd to have issues with new attributes

youngsuh
Contributor

Is this the answer to fixing the issue?

0 Karma

tlabue
Path Finder

For the telemetry.conf file, I also updated the one in .../etc/apps/search/local to set to false all the attributes trying to send data back to Splunk

0 Karma

tlabue
Path Finder

Continuing to look into this, I am wondering if this is all because of the automated reporting. All our instances are on networks cutoff from the main internet. So, I will need to turn off all the attempts to contact the outside world.

I had previously set the following attributes in web.conf:
updateCheckerBaseURL = 0
userRegistrationURL =
docsCheckerBaseURL =

I've now gone into the Instrumentation Panel and disabled Aggregated Usage Data and Support Usage Data. This has removed some of the sporadic TelemetryHandler warnings I was seeing, though I am still seeing the license_warnings_update_interval messages.

0 Karma

tlabue
Path Finder

I have added a telemetry.conf file with the following:
[general]
sendLicenseUsage = false
Though, this has not led to the license_warnings_update_interval_messages abating.

The Instrumentation Panel setting say that the License and Version Data sharing is automatically turned on, though the documentation for telemetry.conf doesn't seem to agree with that.

0 Karma

tlabue
Path Finder

OK, I've added these items:
In limits.conf:
[auth]
enable_install_apps = true

and in server.conf
[license]
license_warnings_update_interval = 60

Both seem to be new attributes. license_warnings_update_internal should default to 0, but I didn't see anything in the default server.conf file, so I set it to a value in the range (10, 3600).

enable_install_apps defaults to false, but generated the deprecated messages, so I changed the value to true.

Seems odd to have issues with new attributes.

0 Karma

rabbidroid
Path Finder

Had the same problem. Please post your reply as an answer, so people know that it was actually answered.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...