Splunk App for DB Connect — 无法与任务服务器通信

适用范围

描述

登录Spunk时，在DB Connect应用的UI中查看错误消息：

Cannot communicate with task server, please check your settings.

无法初始化DB Connect服务器，并且有关splunk_app_db_connect的splunkd中存在错误。 

调查

当看到以下有关DB Connect应用的消息时：

"Cannot communicate with task server" 

检查Splunkd日志（在Search & Reporting应用上）是否存在错误

index=_internal splunk_app_db_connect

1.) 无法初始化模块化输入

ERROR ModularInputs - Unable to initialize modular input "server" defined inside the app 
"splunk_app_db_connect": Introspecting scheme=server: script running 
failed (exited with code 127).

或

2.)__init__.py模块错误

Cannot communicate with task server, please check your settings. 
<?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="WARN">Traceback 
(most recent call last): File "/opt/splunk/bin/rest_handler.py", line 79, in &lt;module&gt; 
print splunk.rest.dispatch(**params) File "/opt/splunk/lib/python2.7/site-packages/splunk/
rest/__init__.py", line 149, in dispatch module = __import__('splunk.rest.external.%s' % 
parts[0], Non, parts[0]) File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxproxy.py", 
line 7, in &lt;module&gt; from dbx_settings import Settings File "/opt/splunk/etc/apps/
splunk_app_db_connect/bin/dbx_settings.py" line 10, in &lt;module&gt; import splunklib.client
as client File "/opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/splunklib/__init__.py", line 18, 
in &lt;module&gt; from splunklib.six.moves import map ImportError: No module named six.moves 
</msg> </messages> </response>

第一个错误消息Unable to Initialize Module Inputs（无法初始化模块输入）需要检查以下内容：

chmod -R 755 <jre_path_folder>
chown -R splunk:splunk <jre_path_folder>  #do this only if you've installed the jre 
in a specific location that only Splunk needs access tochown -R splunk:splunk $SPLUNK_HOME       #if the splunk_app_db_connect folder 
doesn't have the appropriate permissions

netstat -plunt | grep 9998
tcp6       0      0 127.0.0.1:9998     :::*        LISTEN      26739/java

grep -RHwin 9998

第二个错误消息是__init.py__ module errors，您会看到在为__init.py__ module failed import splunklib.client as client File列出的路径中有一个不同的应用，然后您很可能遇到问题DBX-4623,DBX-4623在DB Connect应用的3.1.4版中已修复。

G.) Splunk许可证

对于如下所示的错误消息：

ERROR ExecProcessor [19428 ExecProcessor] - message from "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxquery.sh" action=dbxquery_server_start_failed error=com.splunk.HttpException: HTTP 401 -- call not properly authenticatedERROR ExecProcessor [19428 ExecProcessor] - message from "/opt/splunk/etc/apps/splunk_app_db_connect/bin/server.sh" action=task_server_start_failed error=com.splunk.HttpException: HTTP 401 -- call not properly authenticated

验证安装了db_connect_app的实例上的Splunk许可证，确保该许可证有效且安装正确。应用许可证后，重新启动Splunk服务。

要检查或验证的其他内容：
 

ps aux | grep -i java
splunk 26739  0.1  7.8 7829640 629484 ?  Sl Sep05 38:53 /home/splunk/java8/jdk1.8.0_181/
jre/bin/java -Ddw.server.applicationConnectors[0].port=9998 -jar 
/opt/splunk/etc/apps/splunk_app_db_connect/linux_x86_64/bin/../../jars/server.jarcurl --noproxy localhost -k http://localhost:9998/api/taskserver
{"status":"RUNNING","schedulerStatus":0,"message":"task server is running","info":
{"ProcessName":"26739@somehostname.splunk.com","Uptime":"1202063071", "javaVMName":"Java
HotSpot(TM) 64-Bit Server VM","javaVersion":"1.8.0_181","TotalMemory":"243793920",
"javaVendor":"Oracle Corporation","javaSpecificationVersion":"1.8","MaxMemory":"1823473664",
"FreeMemory":"124765344"},"serverId":"4444-b0ab-a49990dac5fe"}[

"WARN insufficient permission to access this resource"

分辨率

根据遇到的错误消息，调查可遵循两条路径。

可以快速确定问题，可能遇到已知问题DBX-4623，已在DB Connect应用的3.1.4版中修复。看到__init.py__module错误和路径中引用的其他应用程序。使用旧版本的DB Connect（3.1.4之前的版本），升级或降级/禁用冲突应用。

如果遇到“Unable to initialize module input”错误，则很可能是配置或环境问题。调查的步骤应有助于找出问题所在。
 

相关链接

Splunk文档：
Oracle Java Runtime Environment(JRE)第8版
部署和使用Splunk DB Connect

Splunk答案：
获取DB Connect应用的以下连接错误：“无法与任务服务器通信，请检查设置问题。”


DBX-4623:
发行说明

外部文档：
Splunk的Azure监视器插件问题：