ITSI sendmodalert - Alert action script returned error code=255

[jacob_smith14]

I am running itsi 4.9.2 and Splunk 8.1.2.  ITSI is not generating notable events because of this error.  My correlation searches find notable events but they do not get put anywhere because of this error.

I am on a disconnected network so I can't type it all:

WARN sendmodalert - action=itsi_event_generator - Alert action script returned error code 255.

INFO sendmodalert - action=itsi_event_generator - Alert action script completed in duration=1134ms with exit code 255.

There are a bunch of python errors ,most interesting:

ERROR sendmodalert - action=itsi_event_generator - STDERR - SA_ITOA_app_common.solnlib.packages.requests.exceptions.SSLError: HTTPSConnectionPool(127.0.0.1,port=8088): MAx retries exceeded with url: /services/collector (Caused by SSLError(SSLError(1, '[SSL:UNKNOWN_PROTOCOL] unknow protocol (_ssl.c:1106)')))

Not sure when this first started but any help is appreciated!

Thanks!

[jacob_smith14 · Accepted solution]

Forgot to update this one.....the fix is to make sure your HEC, or whatever is set on port 8088 is set to enableSSL=true.

./splunk cmd btool inputs list --debug | grep 8088

Wherever that file is, update that stanza to enableSSL=true.