Splunk Enterprise Security

Why am I getting script failure errors with configuration_check.py that read "A script exited abnormally"?

DEAD_BEEF
Builder

On new install of Splunk Enterprise Security (version 4.7.6), I am seeing the following errors, once an hour. I included a sample of the alerts but it triggers on 7 .sh files every hour on the hour.

2018-09-11 16:00:00,385 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/openPortsEnhanced.sh" stanza="default" status="exited with code 1""

2018-09-11 16:00:00,370 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/lsof.sh" stanza="default" status="exited with code 1""

2018-09-11 16:00:00,355 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/iostat.sh" stanza="default" status="exited with code 1""

Triggers on these scripts

/bin/openPortsEnhanced.sh
/bin/lsof.sh
/bin/iostat.sh
/bin/vmstat.sh
/bin/time.sh
/bin/cpu.sh
/bin/bandwidth.sh
0 Karma
1 Solution

DEAD_BEEF
Builder

I went through and disabled the scripted input as detailed here and here. The errors have since disappeared. Looks like this has been an issue since 2014, surprised it isn't resolved yet...

Settings > Data Inputs > Configuration Checker > confcheck_script_errors

View solution in original post

0 Karma

DEAD_BEEF
Builder

I went through and disabled the scripted input as detailed here and here. The errors have since disappeared. Looks like this has been an issue since 2014, surprised it isn't resolved yet...

Settings > Data Inputs > Configuration Checker > confcheck_script_errors

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...