Troubleshooting » History » Version 3
Luke Murphey, 06/01/2016 04:43 PM
1 | 1 | Luke Murphey | h1. Troubleshooting |
---|---|---|---|
2 | 1 | Luke Murphey | |
3 | 1 | Luke Murphey | Below are some pointers to help in debugging the application: |
4 | 1 | Luke Murphey | |
5 | 1 | Luke Murphey | h2. Search for modular input errors |
6 | 1 | Luke Murphey | |
7 | 1 | Luke Murphey | Run a search for the following and see if the logs indicate a problem with the modular input: |
8 | 1 | Luke Murphey | |
9 | 1 | Luke Murphey | <pre> |
10 | 1 | Luke Murphey | index=_internal sourcetype=web_availability_modular_input |
11 | 1 | Luke Murphey | </pre> |
12 | 1 | Luke Murphey | |
13 | 1 | Luke Murphey | h2. Search for REST handler errors |
14 | 1 | Luke Murphey | |
15 | 1 | Luke Murphey | Run a search for the following and see if the logs indicate a problem with the REST handler: |
16 | 1 | Luke Murphey | |
17 | 1 | Luke Murphey | <pre> |
18 | 1 | Luke Murphey | index=_internal source=*website_monitoring_rest_handler.log |
19 | 1 | Luke Murphey | </pre> |
20 | 2 | Luke Murphey | |
21 | 2 | Luke Murphey | h2. Input fails and generates a "ConnectionError" |
22 | 2 | Luke Murphey | |
23 | 2 | Luke Murphey | This can happen when the following is |
24 | 2 | Luke Murphey | |
25 | 2 | Luke Murphey | # The IP address is invalid (if referring to the host by IP) |
26 | 2 | Luke Murphey | # The domain name cannot be resolved |
27 | 2 | Luke Murphey | # The port number provided is invalid (if a port is specified) |
28 | 2 | Luke Murphey | # Network connectivity is lost or a firewall blocks the connection |
29 | 3 | Luke Murphey | |
30 | 3 | Luke Murphey | h2. Troubleshooting modular inputs that don't appear in the Splunk Manager |
31 | 3 | Luke Murphey | |
32 | 3 | Luke Murphey | Look in the messages link in the top right of the page to see if you have a message like this: |
33 | 3 | Luke Murphey | |
34 | 3 | Luke Murphey | <pre> |
35 | 3 | Luke Murphey | Unable to initialize modular input "web_ping" defined inside the app "website_monitoring": Introspecting scheme=web_input: script running failed (exited with code 1). |
36 | 3 | Luke Murphey | </pre> |
37 | 3 | Luke Murphey | |
38 | 3 | Luke Murphey | You can search the internal log for related errors that indicate the modular input could not start: |
39 | 3 | Luke Murphey | |
40 | 3 | Luke Murphey | <pre> |
41 | 3 | Luke Murphey | index=_internal "ModularInputs - Unable to initialize modular input" |
42 | 3 | Luke Murphey | </pre> |
43 | 3 | Luke Murphey | |
44 | 3 | Luke Murphey | The best way to identify the source of the error if the modular input cannot be loaded by Splunk is to try to load it via Splunk's python interpreter directly. |
45 | 3 | Luke Murphey | |
46 | 3 | Luke Murphey | Here is an example. Consider the modular input is in the following path: /opt/splunk/etc/apps/website_monitoring/bin/web_ping.py |
47 | 3 | Luke Murphey | |
48 | 3 | Luke Murphey | To test this, go to the path /opt/splunk/etc/apps/website_monitoring/bin/ using the CLI: |
49 | 3 | Luke Murphey | |
50 | 3 | Luke Murphey | <pre> |
51 | 3 | Luke Murphey | cd /opt/splunk/etc/apps/website_monitoring/bin/ |
52 | 3 | Luke Murphey | </pre> |
53 | 3 | Luke Murphey | |
54 | 3 | Luke Murphey | Next, run Splunk's python against the file: |
55 | 3 | Luke Murphey | |
56 | 3 | Luke Murphey | <pre> |
57 | 3 | Luke Murphey | /opt/splunk/bin/splunk cmd python web_ping.py |
58 | 3 | Luke Murphey | </pre> |
59 | 3 | Luke Murphey | |
60 | 3 | Luke Murphey | This should show an error, such as: |
61 | 3 | Luke Murphey | |
62 | 3 | Luke Murphey | <pre> |
63 | 3 | Luke Murphey | Traceback (most recent call last): |
64 | 3 | Luke Murphey | File "web_input.py", line 1, in <module> |
65 | 3 | Luke Murphey | somethingnotdefined |
66 | 3 | Luke Murphey | NameError: name 'somethingnotdefined' is not defined |
67 | 3 | Luke Murphey | </pre> |