Alert from Ciscco AMP

[4ndr35v4rg45]

Hello,

Recently I began to recived this notifications, but I don't know what's the reason of this.

msg="A script exited abnormally" input="/opt/splunk/etc/apps/amp4e_events_input/bin/amp4e_events_input.py" stanza="amp4e_events_input://AMP" status="exited with code 1"

I execute amp4e_events_input.py but show the next information

./amp4e_events_input.py

./amp4e_events_input.py: línea 1: import: no se encontró la orden ./amp4e_events_input.py: línea 2: import: no se encontró la orden ./amp4e_events_input.py: línea 3: import: no se encontró la orden ./amp4e_events_input.py: línea 4: import: no se encontró la orden ./amp4e_events_input.py: línea 6: from: no se encontró la orden ./amp4e_events_input.py: línea 8: from: no se encontró la orden ./amp4e_events_input.py: línea 9: from: no se encontró la orden ./amp4e_events_input.py: línea 10: from: no se encontró la orden

Do you know how can I solve it?

Thanks

[pschulze]

Hi @4ndr35v4rg45, if I understand you correctly, those errors appear when you run ./amp4e_events_input.py from inside of the bin directory of the app? Those look like errors with the imports of that file, but they are probably not the same error that you get when running the app as part of Splunk.

Can you check in $SPLUNK_HOME/var/log/splunk/amp4e_events_input.log and see if there are any errors in there? Otherwise, $SPLUNK_HOME/var/log/splunk/web_service.log sometimes contains runtime errors for python scripts, there might be some logs in there relating to apm4e_events_input.py.

[4ndr35v4rg45]

HI @pschulze, thanks for your answer, this alert is in Splunk, you can see these alerts on the screenshot.