Error with clean script when installing NMON

[ghost]

We have NMON running successfully in our nonprod, but when trying to set it up in prod, we are facing the below issue.

7-14-2016 16:04:28.188 -0700 INFO TailingProcessor - Archive file='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon' updated less than 10000ms ago, will not read it until it stops changing. 07-14-2016 16:04:38.190 -0700 INFO TailingProcessor - Archive file='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon' has stopped changing, will read it now. 07-14-2016 16:04:38.190 -0700 INFO ArchiveProcessor - handling file=/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon 07-14-2016 16:04:38.191 -0700 INFO ArchiveProcessor - reading path=/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon (seek=169104 len=170445) 07-14-2016 16:04:38.424 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': Can't locate Time/HiRes.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at /opt/splunk/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.pl line 82. 07-14-2016 16:04:38.424 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': BEGIN failed--compilation aborted at /opt/splunk/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.pl line 82. 07-14-2016 16:04:38.424 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': cat: write error: Broken pipe 07-14-2016 16:04:38.816 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': Can't locate Time/HiRes.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at /opt/splunk/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.pl line 82. 07-14-2016 16:04:38.816 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': BEGIN failed--compilation aborted at /opt/splunk/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.pl line 82. 07-14-2016 16:04:38.816 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': cat: write error: Broken pipe 07-14-2016 16:04:39.046 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': Can't locate Time/HiRes.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at /opt/splunk/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.pl line 82. 07-14-2016 16:04:39.046 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': BEGIN failed--compilation aborted at /opt/splunk/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.pl line 82. 07-14-2016 16:04:39.046 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': cat: write error: Broken pipe 07-14-2016 16:04:39.048 -0700 INFO ArchiveProcessor - Finished processing file '/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon', removing from stats 07-14-2016 16:04:39.048 -0700 WARN TcpOutputProc - The event is missing source information. Event : 2016-07-14 16:04:10.059 -0700 splunkd started (build 220630)\nity 10001 07-14-2016 16:04:39.729 -0700 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

[guilhemmarchand]

Hi !

This error happens because you don't have the software requirements on this/these servers.

When Python 2.7.x is not available, Perl will be used and the Perl Time:HiRes module is required. This is a standard Perl module available by your Os provider, check:

http://nmonsplunk.wikidot.com/documentation:prerequisites:software

And from the app page, requirements are exposed:

• Universal Forwarders clients system lacking a Python 2.7.x interpreter requires Perl WITH Time::HiRes module available **

Simply install the Perl module, the will disappear and things will work as expected.

Don't hesitate to revert if required.

Guilhem

Guilhem Marchand

Le 15 juil. 2016 à 01:08, brownbullet notifications@github.com a écrit :

We have NMON running successfully in our nonprod, but when trying to set it up in prod, we are facing the below issue.

7-14-2016 16:04:28.188 -0700 INFO TailingProcessor - Archive file='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon' updated less than 10000ms ago, will not read it until it stops changing. 07-14-2016 16:04:38.190 -0700 INFO TailingProcessor - Archive file='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon' has stopped changing, will read it now. 07-14-2016 16:04:38.190 -0700 INFO ArchiveProcessor - handling file=/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon 07-14-2016 16:04:38.191 -0700 INFO ArchiveProcessor - reading path=/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon (seek=169104 len=170445) 07-14-2016 16:04:38.424 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': Can't locate Time/HiRes.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at /opt/splunk/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.pl line 82. 07-14-2016 16:04:38.424 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': BEGIN failed--compilation aborted at /opt/splunk/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.pl line 82. 07-14-2016 16:04:38.424 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': cat: write error: Broken pipe 07-14-2016 16:04:38.816 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': Can't locate Time/HiRes.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at /opt/splunk/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.pl line 82. 07-14-2016 16:04:38.816 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': BEGIN failed--compilation aborted at /opt/splunk/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.pl line 82. 07-14-2016 16:04:38.816 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': cat: write error: Broken pipe 07-14-2016 16:04:39.046 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': Can't locate Time/HiRes.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at /opt/splunk/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.pl line 82. 07-14-2016 16:04:39.046 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': BEGIN failed--compilation aborted at /opt/splunk/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.pl line 82. 07-14-2016 16:04:39.046 -0700 ERROR ArchiveContext - From archive='/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon': cat: write error: Broken pipe 07-14-2016 16:04:39.048 -0700 INFO ArchiveProcessor - Finished processing file '/opt/splunk/splunkforwarder/var/run/nmon/var/nmon_repository/p01sml004_160714_1428.nmon', removing from stats 07-14-2016 16:04:39.048 -0700 WARN TcpOutputProc - The event is missing source information. Event : 2016-07-14 16:04:10.059 -0700 splunkd started (build 220630)\nity 10001 07-14-2016 16:04:39.729 -0700 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[ghost]

Thank you Guilhem, That seems to have fixed the issue. I am getting the stats in NMON now

[guilhemmarchand]

Hi,

Glad it works as expected ;)

Happy Splunking !

Guilhem Marchand

Le 15 juil. 2016 à 20:23, brownbullet notifications@github.com a écrit :

Thank you Guilhem, That seems to have fixed the issue. I am getting the stats in NMON now

— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.