Quarantine files framework - Unexpected error during execution

[pellegrini]

Following two error repeats every minute in splunkd.log on Splunk Enterprise

What is causing this?

06-07-2024 10:45:00.314 +0200 ERROR ExecProcessor [2519201 ExecProcessorSchedulerThread] - message from "/data/splunk/bin/python3.7 /data/splunk/etc/apps/search/bin/quarantine_files.py" Quarantine files framework - Unexpected error during execution: Expecting value: line 1 column 1 (char 0)

06-07-2024 10:45:00.314 +0200 ERROR ExecProcessor [2519201 ExecProcessorSchedulerThread] - message from "/data/splunk/bin/python3.7 /data/splunk/etc/apps/search/bin/quarantine_files.py" Quarantine files framework - Setting enable_jQuery2 - Unexpected error during execution: Expecting value: line 1 column 1 (char 0)

[pellegrini · Accepted solution]

In this case a full file systems caused this file below to be empty, even after splunkd restart, it was still empty.. That was the cause of this error:

[splunk@hf001 ~]$ ll /opt/splunk/quarantined_files/
total 8
-rwxr-x--- 1 splunk splunk   0 Jun  7 14:18 quarantine_manifest.json
-rwxr-x--- 1 splunk splunk 208 Mar 16  2023 README.md

Adding Enterprise default config to the file solved the issue:

[splunk@hf001 ~]$ cat /opt/splunk/quarantined_files/quarantine_manifest.json
{"enable_jQuery2": "not-restricted", "enable_unsupported_hotlinked_imports": "not-restricted"}