Project

General

Profile

Troubleshooting » History » Version 9

Luke Murphey, 12/04/2018 06:41 AM

1 1 Luke Murphey
h1. Troubleshooting
2 1 Luke Murphey
3 1 Luke Murphey
Below are some pointers to help in debugging the application:
4 1 Luke Murphey
5 1 Luke Murphey
h2. Search for modular input errors
6 1 Luke Murphey
7 1 Luke Murphey
Run a search for the following and see if the logs indicate a problem with the modular input:
8 1 Luke Murphey
9 1 Luke Murphey
<pre>
10 9 Luke Murphey
index=_internal (sourcetype=web_availability_modular_input ERROR) OR (traceback AND NOT sourcetype=splunkd_ui_access)
11 4 Luke Murphey
</pre>
12 4 Luke Murphey
13 1 Luke Murphey
h2. Search for REST handler errors
14 1 Luke Murphey
15 1 Luke Murphey
Run a search for the following and see if the logs indicate a problem with the REST handler:
16 1 Luke Murphey
17 1 Luke Murphey
<pre>
18 1 Luke Murphey
index=_internal source=*website_monitoring_rest_handler.log
19 1 Luke Murphey
</pre>
20 2 Luke Murphey
21 2 Luke Murphey
h2. Input fails and generates a "ConnectionError"
22 2 Luke Murphey
23 2 Luke Murphey
This can happen when the following is
24 2 Luke Murphey
25 2 Luke Murphey
# The IP address is invalid (if referring to the host by IP)
26 2 Luke Murphey
# The domain name cannot be resolved
27 2 Luke Murphey
# The port number provided is invalid (if a port is specified)
28 2 Luke Murphey
# Network connectivity is lost or a firewall blocks the connection
29 3 Luke Murphey
30 3 Luke Murphey
h2. Troubleshooting modular inputs that don't appear in the Splunk Manager
31 3 Luke Murphey
32 3 Luke Murphey
Look in the messages link in the top right of the page to see if you have a message like this:
33 3 Luke Murphey
34 3 Luke Murphey
<pre>
35 3 Luke Murphey
Unable to initialize modular input "web_ping" defined inside the app "website_monitoring": Introspecting scheme=web_input: script running failed (exited with code 1).
36 3 Luke Murphey
</pre>
37 3 Luke Murphey
38 3 Luke Murphey
You can search the internal log for related errors that indicate the modular input could not start:
39 3 Luke Murphey
40 3 Luke Murphey
<pre>
41 3 Luke Murphey
index=_internal "ModularInputs - Unable to initialize modular input"
42 3 Luke Murphey
</pre>
43 3 Luke Murphey
44 3 Luke Murphey
The best way to identify the source of the error if the modular input cannot be loaded by Splunk is to try to load it via Splunk's python interpreter directly.
45 3 Luke Murphey
46 3 Luke Murphey
Here is an example. Consider the modular input is in the following path:  /opt/splunk/etc/apps/website_monitoring/bin/web_ping.py
47 3 Luke Murphey
48 3 Luke Murphey
To test this, go to the path /opt/splunk/etc/apps/website_monitoring/bin/ using the CLI:
49 3 Luke Murphey
50 3 Luke Murphey
<pre>
51 3 Luke Murphey
cd /opt/splunk/etc/apps/website_monitoring/bin/
52 3 Luke Murphey
</pre>
53 3 Luke Murphey
54 3 Luke Murphey
Next, run Splunk's python against the file:
55 3 Luke Murphey
56 3 Luke Murphey
<pre>
57 3 Luke Murphey
/opt/splunk/bin/splunk cmd python web_ping.py
58 3 Luke Murphey
</pre>
59 3 Luke Murphey
60 3 Luke Murphey
This should show an error, such as:
61 3 Luke Murphey
62 3 Luke Murphey
<pre>
63 3 Luke Murphey
Traceback (most recent call last):
64 3 Luke Murphey
  File "web_input.py", line 1, in <module>
65 3 Luke Murphey
    somethingnotdefined
66 3 Luke Murphey
NameError: name 'somethingnotdefined' is not defined
67 3 Luke Murphey
</pre>
68 5 Luke Murphey
69 5 Luke Murphey
h2. Determining the cause of errors relating to "splunkd connection error"
70 5 Luke Murphey
71 5 Luke Murphey
This happens when the input is running but Splunkd fails to respond when the input attempts to determine if a proxy server was configured. This appears to happen to Splunk installs that are running fine. In most cases that I can verify, it happens when Splunk has just been started. These can likely be safely ignored unless other issues have been observed that are related or if you see a large number of them.
72 6 Luke Murphey
73 6 Luke Murphey
h2. Authentication is failing against sites that use Windows Authentication (a.k.a. NTLM authentication)
74 6 Luke Murphey
75 6 Luke Murphey
Search the Website Monitoring logs for information that indicates which authentication type is being used. The app will attempt to discover the authentication type automatically. If this fails, then authentication will not succeed.
76 6 Luke Murphey
77 6 Luke Murphey
<pre>
78 6 Luke Murphey
| search index=_internal sourcetype="web_availability_modular_input" auth_type
79 6 Luke Murphey
</pre>
80 7 Luke Murphey
81 7 Luke Murphey
h2. Why are newly added URLs triggering continuously irrespective of Interval time? Or, how do I fix errors "Failed to save checkpoint directory"?
82 7 Luke Murphey
83 7 Luke Murphey
This can happen when the app doesn't have access to the modular input checkpoint directory. Check the permissions of the modular input checkpoint directory (e.g. "C:\Program Files\Splunk\var\lib\splunk\modinputs\web_ping") to see if the account that Splunk runs under has read/write access to it.
84 7 Luke Murphey
85 7 Luke Murphey
If it doesn't, edit the permissions. The input should begin functioning correctly as soon as the permissions are set correctly.
86 8 Luke Murphey
87 8 Luke Murphey
h2. Some of my inputs that use authentication are not working and I am seeing the error "Unable to determine authentication type"?
88 8 Luke Murphey
89 8 Luke Murphey
Websites can support several types of authentication. The input tries to determine what type of authentication the website supports. The error "Unable to determine authentication type" occurs when the input couldn't determine the type of authentication that the websites supports. When this happens, it will default to HTTP Basic authentication.