search

jjjw420 / splunk-ibm-websphere-mq-add-on

IBM Websphere MQ add-on for Splunk
3 stars 6 forks source link

Instructions on obtaining the correct Ctypes? #4

Closed jay-tb closed 5 years ago

jay-tb commented 5 years ago

The following is received when attempting to configure a stats input:

11-13-2019 15:24:22.500 -0700 INFO  ExecProcessor - Removing status item "/opt/splunk/etc/apps/mq_ta/bin/mqchs.py (mqchs://Test Channel Status) (isModInput=yes)
11-13-2019 15:24:22.501 -0700 INFO  ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/mq_ta/bin/mqchs.py
11-13-2019 15:24:22.501 -0700 INFO  ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/mq_ta/bin/mqinput.py
11-13-2019 15:24:22.576 -0700 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mq_ta/bin/mqchs.py" Stopping.  Exception occurred in                     ChannelStatusPoller: Both user and password must be instances of str or bytes                     mqchs_stanza:mqchs://Test Channel Status

Conceptually, how would one find the correct Ctypes library appropriate for their system if they weren't sure how to do so?

We have Splunk 7.2.7 deployed on Ubuntu and copying the _ctypes.so from the Python Libraries for Scientific Computing seems to throw the above error -- I suspect due to the UCS2 vs UCS4 encoding difference.

How would one compile a UCS2-compatible _ctypes.so for Ubuntu?

jay-tb commented 5 years ago

Thank you for the updated Troubleshooting section. I have obtained the UCS2 _ctypes.so from a docker-install of Splunk version 8, as you've suggested in the guide.

Thanks again for your work on this add-on!

jjjw420 commented 5 years ago

Sure.

jjjw420 commented 5 years ago

Your exception manes we wonder though. That does not look ctypes related. it look sl like bad conversion from bytes to string.

Let me check. I will post any fixes here.

jjjw420 commented 5 years ago

I'll be honest with you - we use the queue input for events more than the channel stats input. I mostly use it to read MQ messages from queues in many different formats using custom response handlers and produce splunk events (20million events per day).

So there could be bugs. I'm adding an input on each of our types of queue managers with and without auth (i have a special pcf module for zos queue managers too).

Will post results and fixes.