why is the windows app generating crash reports in my windows event logs ?

[yannK]

Since I deployed the windows app on my forwarder, I am seeing crashes reported in my windows event logs. But splunk is still running, and there is no crash in my $SPLUNK_HOME/var/log/splunk. Why !!!!!

[yannK · Accepted solution]

Please check if your windows app is correctly setup.

By default the functionality to resolve Objects names using AD is enables, but the AD name is not filled.

" If you've added some non-standard event log channels and you want to specify whether Active Directory objects like GUIDs and SIDs are resolved for a given Windows event log channel, you can turn on the evt_resolve_ad_obj setting (1=enabled, 0=disabled) for that channel's stanza in your local copy of inputs.conf. evt_resolve_ad_obj is on by default for the Security channel."

the default is

[default] 
evt_resolve_ad_obj = 1 
evt_dc_name = 
evt_dns_name = 

and to fix it you have to edit $SPLUNK_HOME/etc/apps/windows/local/inputs.conf :

• disable the windows app (but it's radical)
• disable AD name resolution it with

[default] 
evt_resolve_ad_obj =0 

• or keep AD name resolution but configure the 2 parameters

evt_dc_name = MYADSERVER.MYDOMAIN.COM
# second is optional
evt_dns_name = the_Fully-qualified_DNS_name_of_the_domain

see examples here http://www.splunk.com/base/Documentation/latest/Admin/Inputsconf and here http://www.splunk.com/base/Documentation/4.2/Data/MonitorWindowsdata

[yannK]

the crashes are not splunkd crashes, but events logged in the windows event log about a process failing (splunk scripted windows inputs calling the AD API)

[jrodman]

Do these crash events have any telltales? There could be crashes for other reasons.