Hi!
This works:
./lea-loggrabber-debug.sh --configentity CP
This does not:
./lea-loggrabber.sh --configentity CP
Message:
ERROR: unable to get splunk lea config arguments(get_fw1_logfiles)
in Splunk gui the "last connection" state will never show anything else than Never Connected.
This is running on a minimal Centos 7 host with index cluster.
here is the opsec.conf file:
[CP]
fw_version = 77
is_disabled = 0
lea_server_auth_port = 18184
lea_server_auth_type = sslca
lea_server_ip = 10.10.102.12
mode = fw
online_mode = 1
#some parts are left out here, I know they work though.
opsec.log:
2015-10-17 21:58:09,963 [INFO] [<string>] remoteRequestHandler: params: {'output_mode': u'json', '': u'servicesNS/admin/Splunk_TA_opseclea_linux22/configs/conf-inputs/script:///opt/splunk/etc/apps/Splunk_TA_opseclea_linux2
2/bin/lea-loggrabber.sh --configentity MFACP', '_': u'1445111873118', 'targetHost': u'localhost'}
2015-10-17 21:58:09,963 [INFO] [<string>] remoteRequestHandler: qs: output_mode=json&targetHost=localhost&_=1445111873118
2015-10-17 21:58:09,963 [INFO] [<string>] remoteRequestHandler: qs: output_mode=json&targetHost=localhost&_=1445111873118
2015-10-17 21:58:09,963 [INFO] [<string>] query arg:output_mode
2015-10-17 21:58:09,963 [INFO] [<string>] query arg:_
2015-10-17 21:58:09,963 [INFO] [<string>] query arg:targetHost
2015-10-17 21:58:09,963 [INFO] [<string>] query args dict: {'output_mode': 'json', 'targetHost': 'localhost'}
2015-10-17 21:58:09,963 [INFO] [<string>] remote_request: no_cache: False
2015-10-17 21:58:09,964 [INFO] [<string>] remote_request: qs: {'output_mode': 'json', 'targetHost': 'localhost'}
2015-10-17 21:58:09,964 [INFO] [<string>] remote_request: postargs: None
2015-10-17 21:58:09,964 [INFO] [<string>] remote: fetch all uri: /servicesNS/admin/Splunk_TA_opseclea_linux22/configs/conf-inputs/script%3A%252F%252F%252Fopt%252Fsplunk%252Fetc%252Fapps%252FSplunk_TA_opseclea_linux22%252Fbin%252Flea-loggrabber.sh%20--configentity%20MFACP?output_mode=json&count=0&sort_mode=natural&offset=0
2015-10-17 21:58:09,964 [INFO] [<string>] remote_request: targetHost: localhost
2015-10-17 21:58:09,964 [INFO] [<string>] Requesting from peers: ['localhost']
2015-10-17 21:58:09,964 [INFO] [cached.py] cache key: ('eAfSfXA3274WMz^C_ARN8w224QnRKJmTx5A2sjhXLfboyNtCMeNfEFHS^x49BIvpllQsi_uCyx0hTLNKqkQAZ2CTbm25LCiWuS5XpM5iPsDxqq5Ns6ivYM_AXe21LFIc6gZXY8L', ('/servicesNS/admin/Splunk_TA_opseclea_linux22/configs/conf-inputs/script%3A%252F%252F%252Fopt%252Fsplunk%252Fetc%252Fapps%252FSplunk_TA_opseclea_linux22%252Fbin%252Flea-loggrabber.sh%20--configentity%20MFACP?output_mode=json&count=0&sort_mode=natural&offset=0', 'localhost', True))
2015-10-17 21:58:09,964 [INFO] [cached.py] caching data (cache miss)
2015-10-17 21:58:09,964 [INFO] [peer.py] peer: uri: /servicesNS/admin/Splunk_TA_opseclea_linux22/configs/conf-inputs/script%3A%252F%252F%252Fopt%252Fsplunk%252Fetc%252Fapps%252FSplunk_TA_opseclea_linux22%252Fbin%252Flea-loggrabber.sh%20--configentity%20MFACP?output_mode=json&count=0&sort_mode=natural&offset=0
2015-10-17 21:58:09,964 [INFO] [peer.py] peer: postargs: None
2015-10-17 21:58:09,964 [INFO] [peer.py] peer: body: None
2015-10-17 21:58:09,964 [INFO] [peer.py] peer: method: GET
2015-10-17 21:58:09,970 [INFO] [peer.py] peer: nEntries: 1
2015-10-17 21:58:09,971 [INFO] [<string>] sort params {'output_mode': 'json'}
2015-10-17 21:58:09,971 [INFO] [<string>] sorting by name
2015-10-17 21:58:09,971 [INFO] [<string>] 1 entries
2015-10-17 21:58:09,971 [INFO] [<string>] start: 0, end: 30
2015-10-17 21:58:09,979 [INFO] [<string>] remoteRequestHandler: params: {'output_mode': u'json', 'host': u'osludfw01', 'passAuth': u'splunk-system-user', 'index': u'CP', '': u'servicesNS/admin/Splunk_TA_opseclea_linux22/configs/conf-inputs/script:///opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity MFACP', 'interval': u'30', 'sourcetype': u'opsec', 'disabled': u'1', 'targetHost': u'localhost'}
2015-10-17 21:58:09,980 [INFO] [<string>] remoteRequestHandler: qs:
2015-10-17 21:58:09,980 [INFO] [<string>] remote_request: no_cache: False
2015-10-17 21:58:09,980 [INFO] [<string>] remote_request: qs: {'output_mode': 'json'}
2015-10-17 21:58:09,980 [INFO] [<string>] remote_request: postargs: {'host': 'osludfw01', 'passAuth': 'splunk-system-user', 'index': 'CP', 'interval': '30', 'sourcetype': 'opsec', 'disabled': '1', 'targetHost': 'localhost'}
2015-10-17 21:58:09,980 [INFO] [<string>] remote: fetch all uri: /servicesNS/admin/Splunk_TA_opseclea_linux22/configs/conf-inputs/script%3A%252F%252F%252Fopt%252Fsplunk%252Fetc%252Fapps%252FSplunk_TA_opseclea_linux22%252Fbin%252Flea-loggrabber.sh%20--configentity%20MFACP?output_mode=json&count=0&sort_mode=natural&offset=0
2015-10-17 21:58:09,980 [INFO] [<string>] remote_request: targetHost: localhost
2015-10-17 21:58:09,980 [INFO] [<string>] Requesting from peers: ['localhost']
2015-10-17 21:58:09,980 [INFO] [<string>] flush cache
2015-10-17 21:58:09,980 [INFO] [peer.py] flushPeer: localhost
2015-10-17 21:58:09,980 [INFO] [peer.py] done flushing peer
2015-10-17 21:58:09,980 [INFO] [cached.py] Not using cache
2015-10-17 21:58:09,981 [INFO] [peer.py] peer: uri: /servicesNS/admin/Splunk_TA_opseclea_linux22/configs/conf-inputs/script%3A%252F%252F%252Fopt%252Fsplunk%252Fetc%252Fapps%252FSplunk_TA_opseclea_linux22%252Fbin%252Flea-loggrabber.sh%20--configentity%20MFACP?output_mode=json&count=0&sort_mode=natural&offset=0
2015-10-17 21:58:09,981 [INFO] [peer.py] peer: postargs: {'host': 'osludfw01', 'interval': '30', 'passAuth': 'splunk-system-user', 'index': 'CP', 'sourcetype': 'opsec', 'disabled': '1'}
2015-10-17 21:58:09,981 [INFO] [peer.py] peer: body: None
2015-10-17 21:58:09,981 [INFO] [peer.py] peer: method: POST
2015-10-17 21:58:09,988 [INFO] [peer.py] peer: nEntries: 1
2015-10-17 21:58:09,998 [INFO] [<string>] remoteRequestHandler: params: {'output_mode': u'json', '': u'servicesNS/admin/Splunk_TA_opseclea_linux22/data/inputs/script/_reload', 'targetHost': u'localhost'}
2015-10-17 21:58:09,998 [INFO] [<string>] remoteRequestHandler: qs:
2015-10-17 21:58:09,998 [INFO] [<string>] remote_request: no_cache: False
2015-10-17 21:58:09,998 [INFO] [<string>] remote_request: qs: {'output_mode': 'json'}
2015-10-17 21:58:09,998 [INFO] [<string>] remote_request: postargs: {'targetHost': 'localhost'}
2015-10-17 21:58:09,998 [INFO] [<string>] remote: fetch all uri: /servicesNS/admin/Splunk_TA_opseclea_linux22/data/inputs/script/_reload?output_mode=json&count=0&sort_mode=natural&offset=0
2015-10-17 21:58:09,998 [INFO] [<string>] remote_request: targetHost: localhost
2015-10-17 21:58:09,998 [INFO] [<string>] Requesting from peers: ['localhost']
2015-10-17 21:58:09,999 [INFO] [<string>] flush cache
2015-10-17 21:58:09,999 [INFO] [peer.py] flushPeer: localhost
2015-10-17 21:58:09,999 [INFO] [peer.py] done flushing peer
2015-10-17 21:58:09,999 [INFO] [cached.py] Not using cache
2015-10-17 21:58:09,999 [INFO] [peer.py] peer: uri: /servicesNS/admin/Splunk_TA_opseclea_linux22/data/inputs/script/_reload?output_mode=json&count=0&sort_mode=natural&offset=0
2015-10-17 21:58:09,999 [INFO] [peer.py] peer: postargs: {}
2015-10-17 21:58:09,999 [INFO] [peer.py] peer: body: None
2015-10-17 21:58:09,999 [INFO] [peer.py] peer: method: POST
2015-10-17 21:58:10,011 [INFO] [peer.py] peer: nEntries: 0
2015-10-17 21:58:10,011 [INFO] [<string>] 0 entries
2015-10-17 21:58:10,011 [INFO] [<string>] start: 0, end: 30
2015-10-17 21:58:10,529 [INFO] [<string>] remoteRequestHandler: params: {'output_mode': u'json', 'count': u'-1', '_': u'1445111890178', '': u'servicesNS/admin/Splunk_TA_opseclea_linux22/opsec/getScriptedInputPath'}
2015-10-17 21:58:10,530 [INFO] [<string>] remoteRequestHandler: qs: output_mode=json&count=-1&_=1445111890178
2015-10-17 21:58:10,530 [INFO] [<string>] remoteRequestHandler: qs: output_mode=json&count=-1&_=1445111890178
2015-10-17 21:58:10,530 [INFO] [<string>] query arg:output_mode
2015-10-17 21:58:10,530 [INFO] [<string>] query arg:count
2015-10-17 21:58:10,530 [INFO] [<string>] query arg:_
2015-10-17 21:58:10,530 [INFO] [<string>] query args dict: {'output_mode': 'json', 'count': '-1'}
2015-10-17 21:58:10,530 [INFO] [<string>] remote_request: no_cache: False
2015-10-17 21:58:10,530 [INFO] [<string>] remote_request: qs: {'output_mode': 'json', 'count': '-1'}
2015-10-17 21:58:10,530 [INFO] [<string>] remote_request: postargs: None
2015-10-17 21:58:10,530 [INFO] [<string>] remote: fetch all uri: /servicesNS/admin/Splunk_TA_opseclea_linux22/opsec/getScriptedInputPath?output_mode=json&count=0&sort_mode=natural&offset=0
2015-10-17 21:58:10,539 [INFO] [<string>] Requesting from peers: ['localhost']
2015-10-17 21:58:10,540 [INFO] [cached.py] cache key: ('eAfSfXA3274WMz^C_ARN8w224QnRKJmTx5A2sjhXLfboyNtCMeNfEFHS^x49BIvpllQsi_uCyx0hTLNKqkQAZ2CTbm25LCiWuS5XpM5iPsDxqq5Ns6ivYM_AXe21LFIc6gZXY8L', ('/servicesNS/admin/Splunk_TA_opseclea_linux22/opsec/getScriptedInputPath?output_mode=json&count=0&sort_mode=natural&offset=0', 'localhost', True))
2015-10-17 21:58:10,540 [INFO] [cached.py] caching data (cache miss)
2015-10-17 21:58:10,540 [INFO] [peer.py] peer: uri: /servicesNS/admin/Splunk_TA_opseclea_linux22/opsec/getScriptedInputPath?output_mode=json&count=0&sort_mode=natural&offset=0
2015-10-17 21:58:10,540 [INFO] [peer.py] peer: postargs: None
2015-10-17 21:58:10,540 [INFO] [peer.py] peer: body: None
2015-10-17 21:58:10,540 [INFO] [peer.py] peer: method: GET
2015-10-17 21:58:10,707 [INFO] [peer.py] peer: nEntries: 1
2015-10-17 21:58:10,708 [INFO] [<string>] sort params {'output_mode': 'json', 'count': '-1'}
2015-10-17 21:58:10,708 [INFO] [<string>] sorting by name
2015-10-17 21:58:10,708 [INFO] [<string>] 1 entries
2015-10-17 21:58:10,708 [INFO] [<string>] start: 0, end: -1
2015-10-17 21:58:10,708 [INFO] [<string>] cannot paginate this endpoint
2015-10-17 21:58:10,806 [INFO] [<string>] remoteRequestHandler: params: {'output_mode': u'json', 'count': u'-1', '_': u'1445111890198', 'search': u'name=*configentity*', '': u'servicesNS/admin/Splunk_TA_opseclea_linux22/configs/conf-inputs'}
2015-10-17 21:58:10,806 [INFO] [<string>] remoteRequestHandler: qs: output_mode=json&count=-1&search=name%3D*configentity*&_=1445111890198
2015-10-17 21:58:10,806 [INFO] [<string>] remoteRequestHandler: qs: output_mode=json&count=-1&search=name%3D*configentity*&_=1445111890198
2015-10-17 21:58:10,806 [INFO] [<string>] query arg:output_mode
2015-10-17 21:58:10,807 [INFO] [<string>] query arg:count
2015-10-17 21:58:10,807 [INFO] [<string>] query arg:_
2015-10-17 21:58:10,807 [INFO] [<string>] query arg:search
2015-10-17 21:58:10,807 [INFO] [<string>] query args dict: {'output_mode': 'json', 'count': '-1', 'search': 'name=*configentity*'}
↧