Splunk Enterprise Security

Why am I getting script failure errors with configuration_check.py that read "A script exited abnormally"?

DEAD_BEEF
Builder

On new install of Splunk Enterprise Security (version 4.7.6), I am seeing the following errors, once an hour. I included a sample of the alerts but it triggers on 7 .sh files every hour on the hour.

2018-09-11 16:00:00,385 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/openPortsEnhanced.sh" stanza="default" status="exited with code 1""

2018-09-11 16:00:00,370 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/lsof.sh" stanza="default" status="exited with code 1""

2018-09-11 16:00:00,355 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/iostat.sh" stanza="default" status="exited with code 1""

Triggers on these scripts

/bin/openPortsEnhanced.sh
/bin/lsof.sh
/bin/iostat.sh
/bin/vmstat.sh
/bin/time.sh
/bin/cpu.sh
/bin/bandwidth.sh
0 Karma
1 Solution

DEAD_BEEF
Builder

I went through and disabled the scripted input as detailed here and here. The errors have since disappeared. Looks like this has been an issue since 2014, surprised it isn't resolved yet...

Settings > Data Inputs > Configuration Checker > confcheck_script_errors

View solution in original post

0 Karma

DEAD_BEEF
Builder

I went through and disabled the scripted input as detailed here and here. The errors have since disappeared. Looks like this has been an issue since 2014, surprised it isn't resolved yet...

Settings > Data Inputs > Configuration Checker > confcheck_script_errors

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

  March 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

New This Month - Splunk Observability updates and improvements for faster ...

What’s New? This month, we’re delivering several enhancements across Splunk Observability Cloud for faster and ...

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...