search

doksu / TA-pyLDAP

Python LDAP Technology Add-On for Splunk
Other
1 stars 1 forks source link

error on execute (missing shared python library) #3

Open steadfasterX opened 3 years ago

steadfasterX commented 3 years ago

splunk version: 8.1.4

error: Error in 'ldapquery' command: External search command exited unexpectedly with non-zero error code 1.

from search log:

05-20-2021 16:29:16.242 INFO  ChunkedExternProcessor - Running process: /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-pyLDAP/bin/ldapquery.py
05-20-2021 16:29:16.358 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last):
05-20-2021 16:29:16.358 ERROR ChunkedExternProcessor - stderr:   File "/opt/splunk/etc/apps/TA-pyLDAP/bin/ldapquery.py", line 6, in <module>
05-20-2021 16:29:16.358 ERROR ChunkedExternProcessor - stderr:     import ldap
05-20-2021 16:29:16.358 ERROR ChunkedExternProcessor - stderr:   File "/opt/splunk/etc/apps/TA-pyLDAP/bin/ldap/__init__.py", line 27, in <module>
05-20-2021 16:29:16.358 ERROR ChunkedExternProcessor - stderr:     import _ldap
05-20-2021 16:29:16.358 ERROR ChunkedExternProcessor - stderr: ImportError: libpython3.6m.so.1.0: cannot open shared object file: No such file or directory
05-20-2021 16:29:16.370 ERROR ChunkedExternProcessor - EOF while attempting to read transport header read_size=0
05-20-2021 16:29:16.370 ERROR ChunkedExternProcessor - Error in 'ldapquery' command: External search command exited unexpectedly with non-zero error code 1.
05-20-2021 16:29:16.371 INFO  ScopedTimer - search.optimize 0.129242938
05-20-2021 16:29:16.371 INFO  SearchPhaseGenerator - Failed to create phases using AST:Error in 'ldapquery' command: External search command exited unexpectedly with non-zero error code 1.. Falling back to 2 phase mode.
doksu commented 3 years ago

Thanks @steadfasterX , is https://github.com/doksu/TA-pyLDAP/blob/master/bin/_ldap.so present in the app on your Splunk server?

steadfasterX commented 3 years ago

Thanks @steadfasterX , is https://github.com/doksu/TA-pyLDAP/blob/master/bin/_ldap.so present in the app on your Splunk server?

Yes

doksu commented 3 years ago

What operating system are you using?

steadfasterX commented 3 years ago

What operating system are you using?

RHEL 7

stboch commented 3 years ago

Splunk 8.1 is running Python 3.7 BTW