Splunk Enterprise Security

Why am I getting script failure errors with configuration_check.py that read "A script exited abnormally"?

DEAD_BEEF
Builder

On new install of Splunk Enterprise Security (version 4.7.6), I am seeing the following errors, once an hour. I included a sample of the alerts but it triggers on 7 .sh files every hour on the hour.

2018-09-11 16:00:00,385 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/openPortsEnhanced.sh" stanza="default" status="exited with code 1""

2018-09-11 16:00:00,370 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/lsof.sh" stanza="default" status="exited with code 1""

2018-09-11 16:00:00,355 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/iostat.sh" stanza="default" status="exited with code 1""

Triggers on these scripts

/bin/openPortsEnhanced.sh
/bin/lsof.sh
/bin/iostat.sh
/bin/vmstat.sh
/bin/time.sh
/bin/cpu.sh
/bin/bandwidth.sh
0 Karma
1 Solution

DEAD_BEEF
Builder

I went through and disabled the scripted input as detailed here and here. The errors have since disappeared. Looks like this has been an issue since 2014, surprised it isn't resolved yet...

Settings > Data Inputs > Configuration Checker > confcheck_script_errors

View solution in original post

0 Karma

DEAD_BEEF
Builder

I went through and disabled the scripted input as detailed here and here. The errors have since disappeared. Looks like this has been an issue since 2014, surprised it isn't resolved yet...

Settings > Data Inputs > Configuration Checker > confcheck_script_errors

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...