ERROR PersistentScript [1983080 PersistentScriptIo] - From {/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-sophos-central-addon-for-splunk/bin/TA_sophos_central_addon_for_splunk_rh_settings.py persistent}: . This is a known bug in the Add-on Builder (AoB) framework — not specific to the Azure AD add-on. It affects any Splunk TA built with AoB that has an encrypted proxy_password field. I've confirmed it on multiple TAs (Sophos Central, Trend Micro XDR, Signal Sciences, and this one). Root cause (code-level) AoB-generated REST handlers use solnlib's @retry decorator, which logs a WARNING to stderr for any exception — including CredentialNotExistException — before re-raising it: # solnlib/utils.py — @retry decorator
except Exception as e:
logging.warning("Run function: %s failed: %s.", func.__name__, traceback.format_exc())
raise # re-raises immediately for non-retriable exceptions Splunk captures stderr from persistent scripts as ERROR entries in _internal. So the error is cosmetic — the TA is working correctly. Data ingestion is not affected. The underlying trigger is in decrypt_for_get (splunktaucclib/rest_handler/credentials.py): when proxy_password is absent or empty in the conf, it evaluates as falsy, so the auto-creation of the credential is skipped: except CredentialNotExistException:
if field_name in data and data[field_name]: # empty string = falsy → never executes
self._set(name, encrypting) # credential never created → error on every call Fix Option A — via the Splunk UI (per-instance, immediate): Apps → Add-on Configuration → Proxy tab → enter any non-empty value (e.g. x) in the Proxy Password field → Save This creates the credential entry in passwords.conf. The error disappears within ~30 seconds. Option B — via deployment package (for Deployment Server or bulk rollout): Add to local/ta_ms_aad_settings.conf: [proxy]
proxy_password = ******
proxy_type = http The literal string ****** is truthy, so the handler auto-creates the credential in passwords.conf on first startup. No UI interaction needed on each HF. Why this happens only after upgrading to 3.2.0 The newer version likely regenerated the REST handler via a newer AoB version that added the proxy_password encrypted field. Any instance that never configured the Proxy tab will be missing the credential. Upstream status: filed as wontfix in at least one affected TA (sigsci-splunk-app#42). The bug is in the AoB library, not in individual TAs.
... View more
