All Apps and Add-ons

Experiencing error: splunk-monitornohandle - configure: no drive specifier found

suzakutheknight
Explorer

We are receinving the error below in our environment after deploying the Splunk Add-on for Microsoft Windows:

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - configure: no drive specifier found: '$windir\system32\dns\dns.log'

The target systems are running Windows Server 2012 R2 Standard, and the universal forwarder is running as the local system account.

Splunk Component Versions:
Splunk Enterprise 8.0.1
Splunk Universal Forwarder 7.3.4
Splunk Add-on for Microsoft Windows 7.0.0

Any guidance on troubleshooting this would be greatly appreciated.

Labels (1)
1 Solution

jwiedow
Communicator

If you change the monitor stanza to use the actual drive letter (C:\Windows) instead of $windir does it work?

View solution in original post

0 Karma

LeandroKopke
Explorer

Hello everyone!

I'm also having issues for DNS Debug logs and getting this same error
Besides this adjustment, is there anything else to do?

I already changed the input "MonitorNoHandle://$WINDIR\System32\Dns\dns.log" to "MonitorNoHandle://C:\Windows\System32\Dns\dns.log" and vice versa, but it didn't work for "MonitorNoHandle ". Would it be a bug known?

ERROR ExecProcessor [19092 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - configure: Failed to create local heap. Error=(0x8)

 

Thanks!

0 Karma

jwiedow
Communicator

If you change the monitor stanza to use the actual drive letter (C:\Windows) instead of $windir does it work?

0 Karma

suzakutheknight
Explorer

Sorry for the delay, I wanted to run the updated configuration for long enough to validate the change.

Updating the input from "MonitorNoHandle://$WINDIR\System32\Dns\dns.log" to "MonitorNoHandle://C:\Windows\System32\Dns\dns.log" does indeed resolve the issue. What's really odd though is the $WINDIR variable seems to be working in other inputs. For example, "monitor://$WINDIR\WindowsUpdate.log" being enabled does not generate the error.

My guess is that the issue is something specific to the resolution of environment variables by the MonitorNoHandle process. While all of our systems do have C: for the OS drive, it would be more ideal to use the environment variable to protect against edge cases. Is there any thing else we can do to troubleshoot further, or is it time for a bug report?

0 Karma

jwiedow
Communicator

Good to know. Have you tried 8.0.0 of the Splunk Add-on for Microsoft Windows and seen if the issue persists there with the variable substitution?

0 Karma

warwicks
Explorer

Can confirm the issue persists for the [MonitorNoHandle://$WINDIR\System32\Dns\dns.log] input in v8.2.0 of the Windows TA.
This input resolves $WINDIR fine [monitor://$WINDIR\debug\netlogon.log] but as per the OP this input does not  [MonitorNoHandle://$WINDIR\System32\Dns\dns.log].

suzakutheknight
Explorer

We have not. I'll get that and updating the Windows Server 2012 forwarders to 7.3.5 onto our patching schedule to see if either resolves the issue. Given that will not be a swift process due to some bureaucracy, would it be best to mark this question as resolved with removing the environmental variable as a work around solution?

0 Karma

jwiedow
Communicator

I would try to test it on at least one test server and see if it resolves the problem. I don't see anything in the release notes about it fixing an issue with the monitor-nohandle but that doesn't necessarily mean anything.

The quickest thing to do is to open a support case with the information and see if they are aware of the issue. It definitely sounds like a bug.

0 Karma

SUNDAY
Engager

Just a thought - what if the $WINDIR resolves correctly in all cases, but the file or folder is actually missing, and the error message is misleading? 

Has it been checked that both $WINDIR\debug\netlogon.log and $WINDIR\syetem32\dns\dns.log exist and are readable? 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...