Splunk Enterprise Security

Why am I getting script failure errors with configuration_check.py that read "A script exited abnormally"?

Builder

On new install of Splunk Enterprise Security (version 4.7.6), I am seeing the following errors, once an hour. I included a sample of the alerts but it triggers on 7 .sh files every hour on the hour.

2018-09-11 16:00:00,385 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/openPortsEnhanced.sh" stanza="default" status="exited with code 1""

2018-09-11 16:00:00,370 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/lsof.sh" stanza="default" status="exited with code 1""

2018-09-11 16:00:00,355 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/iostat.sh" stanza="default" status="exited with code 1""

Triggers on these scripts

/bin/openPortsEnhanced.sh
/bin/lsof.sh
/bin/iostat.sh
/bin/vmstat.sh
/bin/time.sh
/bin/cpu.sh
/bin/bandwidth.sh
0 Karma
1 Solution

Builder

I went through and disabled the scripted input as detailed here and here. The errors have since disappeared. Looks like this has been an issue since 2014, surprised it isn't resolved yet...

Settings > Data Inputs > Configuration Checker > confcheck_script_errors

View solution in original post

0 Karma

Builder

I went through and disabled the scripted input as detailed here and here. The errors have since disappeared. Looks like this has been an issue since 2014, surprised it isn't resolved yet...

Settings > Data Inputs > Configuration Checker > confcheck_script_errors

View solution in original post

0 Karma