Hi ,
I have a Microsoft Log Analytics Add-on on a heavy forwarder with interval as 60 sec and lag time as 15 min.
Everything works fine till I get below errors-
Query:- index=_internal ERROR sourcetype="ta:ms:loganalytics:log"
Output:-
2018-10-10 08:13:27,405 ERROR pid=10992 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
File "F:\Splunk\etc\apps\TA-ms-loganalytics\bin\ta_ms_loganalytics\modinput_wrapper\base_modinput.py", line 127, in stream_events
self.collect_events(ew)
File "F:\Splunk\etc\apps\TA-ms-loganalytics\bin\log_analytics.py", line 96, in collect_events
input_module.collect_events(self, ew)
File "F:\Splunk\etc\apps\TA-ms-loganalytics\bin\input_module_log_analytics.py", line 72, in collect_events
response = requests.post(uri,json=search_params,headers=headers)
File "F:\Splunk\etc\apps\TA-ms-loganalytics\bin\ta_ms_loganalytics\requests\api.py", line 110, in post
return request('post', url, data=data, json=json, **kwargs)
File "F:\Splunk\etc\apps\TA-ms-loganalytics\bin\ta_ms_loganalytics\requests\api.py", line 56, in request
return session.request(method=method, url=url, **kwargs)
File "F:\Splunk\etc\apps\TA-ms-loganalytics\bin\ta_ms_loganalytics\requests\sessions.py", line 488, in request
resp = self.send(prep, **send_kwargs)
File "F:\Splunk\etc\apps\TA-ms-loganalytics\bin\ta_ms_loganalytics\requests\sessions.py", line 641, in send
r.content
File "F:\Splunk\etc\apps\TA-ms-loganalytics\bin\ta_ms_loganalytics\requests\models.py", line 781, in content
self._content = bytes().join(self.iter_content(CONTENT_CHUNK_SIZE)) or bytes()
File "F:\Splunk\etc\apps\TA-ms-loganalytics\bin\ta_ms_loganalytics\requests\models.py", line 706, in generate
raise ChunkedEncodingError(e)
ChunkedEncodingError: ('Connection broken: IncompleteRead(0 bytes read)', IncompleteRead(0 bytes read))
2018-10-10 08:19:04,789 ERROR pid=7208 tid=MainThread file=base_modinput.py:log_error:307 | OMSInputName="omslog" status="502" step="Post Query" response="<html>
<head><title>502 Bad Gateway</title></head>
<body bgcolor="white">
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx</center>
</body>
</html>
"
Once this error comes, OMS data flow gets stopped until I re-enable input. and when I re-enable input it again starts flowing.
Can any one help me? What will be the issue causing data to stopped and not reconnecting again once issue is resolved?
... View more