Splunk Enterprise

File Integrity Check Error in Heavy Forwarder Server

anandhalagaras1
Communicator

In my Heavy Forwarder server I am seeing this message as below recently in the messages tab. 

File Integrity checks found 114 files that did not match the system-provided manifest. Review the list of problems reported by the InstalledFileHashChecker in splunkd.log File Integrity Check View ; potentially restore files from installation media, change practices to avoid changing files, or work with support to identify the problem. Learn more.

So how can we get it fixed.

 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It's best to not touch any app that ships with Splunk.

The HF and DS do not need the app, although it can be used on an HF.  Do not uninstall it.  It is safe to disable it.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The message pretty much says what you need to do.

Login to the HF and open the Search & Reporting app.  Click on the Dashboards tab then select "Integrity Check of Installed Files".  That dashboard will list the files that failed integrity checks.

To fix them:

1) Undo any changes made to the files or restore them from the download file that installed them.

2) NEVER change a file in a 'default' directory.

---
If this reply helps you, Karma would be appreciated.
0 Karma

anandhalagaras1
Communicator

@richgalloway

Thanks for your response.

Recently we have upgraded the app "Upgrade Readiness App" to the latest version 4.1.1 in the HF server post which i am getting the error message in Splunk.

As you have mentioned I have navigated to the Dashboard section and then I have clicked the "Integrity Check of Installed Files" dashboard and here I can see the file path and results and for all of them it seems to be triggered from Upgrade Readiness App only. Refer below:

So how can we get it fixed.

File path Check result
/opt/splunk/etc/apps/python_upgrade_readiness_app/appserver/static/pages/jquery_scan.js differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/appserver/static/pages/python_scan.js differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/appserver/static/pages/setting.js differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/appserver/static/pages/setting_scan.js differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/appserver/static/pages/splunk9x_scan.js differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/bin/eura_app_list.py differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/bin/eura_check_mongodb_tls_dns_validation.py differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/bin/eura_check_python_tls.py differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/bin/eura_check_search_peer_ssl_config.py differs
/opt/splunk/etc/apps/python_upgrade_readiness_app/bin/eura_email_notification_switch_scripted_input.py differs

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The Upgrade Readiness App ships with Splunk and so should not be upgraded separately.  That Splunk allows it to be upgraded is a mistake, IMO.

You can try downgrading the app or just live with the file integrity warnings.

---
If this reply helps you, Karma would be appreciated.
0 Karma

anandhalagaras1
Communicator

@richgalloway ,

Thank you for the information. 

So is this app  really required to be present in HF and DM server and if its not really needed then  can we uninstall the app?

Or can we disable the app in our HF and DM server.

Which can be a recommended solution here. Please suggest.

 

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's best to not touch any app that ships with Splunk.

The HF and DS do not need the app, although it can be used on an HF.  Do not uninstall it.  It is safe to disable it.

---
If this reply helps you, Karma would be appreciated.

anandhalagaras1
Communicator

@richgalloway 

Thank you for your valuable inputs.

Much appreciated.

As of now I will disable them in HF and DM servers.

 

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...