We've deployed this app to all our XenApp Servers (~20 Win 2008 R2, XenApp 6.5, Splunk 6.2) - everything working great except this error showing up for all servers constantly, from this script: GetXAApplicationReport6x.ps1 - I believe line 42 char:34. Hard to tell because the error string is split into multiple events in the index but I think the full error is:
Split-Path : Cannot bind argument to parameter 'Path' because it is an empty string.
At C:/Program Files/SplunkUniversalForwarder/etc/apps/TA-XA6x-ZDC/bin/powershell/GetXAApplicationReport6x.ps1:42 char:34
+ $ProcessName = Split-Path <<<< $c[0] -Leaf
+ CategoryInfo : InvalidData: (:) [Split-Path], ParameterBindingValidationException
+ FullyQualifiedErrorId : > ParameterArgumentValidationErrorEmptyStringNotAllowed,Microsoft.PowerShell.Commands.SplitPathCommand
I suspect it's benign as I believe all our dashboards are populating but would be nice to clean this up if possible.
This is probably because you have published desktops - which do not have any "CommandLine".
So you could change the Get-XAApplicationReport line:
foreach( $Application in (Get-XAApplicationReport * ) ) {
to:
foreach( $Application in (Get-XAApplicationReport * | where-object {$_.ApplicationType -ne "ServerDesktop"}) ) {
Then it will not check those published "app".,This is probably because you have published desktops - which do not have any "CommandLine".
So you could change the Get-XAApplicationReport line:
foreach( $Application in (Get-XAApplicationReport * ) ) {
to:
foreach( $Application in (Get-XAApplicationReport * | where-object {$_.ApplicationType -ne "ServerDesktop"}) ) {
Then it will not check those published "app".
Hello jconger,
I Installed the Splunk XenApp template 1.1.1on my Linux box. And the following error in splunkd.log is displayed:
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + ~~~~~~~~~~~~~~~~~~~~~~~~~~
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + CategoryInfo : InvalidData: (:) [Split-Path], ParameterBindingV
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" alidationException
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAl
07-16-2015 07:40:29.614 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" lowed,Microsoft.PowerShell.Commands.SplitPathCommand
What can I do to solve this issue.
The next Thing is not all Perf is displayed (e.g. Memory Metrics, System Metrics and Disk Metrics are empty. CPU, Page file and Network metrics are shown.
Thanks for your support
Cheers Nicolay
Did you update the TA-XA6x-ZDC on your Zone Data Collector? The PowerShell script in that TA was changed to fix the original issue.
Hello,
yes I did that - just do be sure I copied the folder again. Got still the same Error:
copied:template-for-citrix-xenapp_111
on my zdc its also xml broker
- TA-XA6x-XML
--TA-XA6x-ZDC
on my worker
TA-XA6x-Server
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" At C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershel
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" l\GetXAApplicationReport6x.ps1:26 char:42
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + $ProcessName = (Split-Path -leaf ( $c[0] -replace '"','' ))
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" -replace ". ...
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + ~~~~~~~~~~~~~~~~~~~~~~~~~~
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + CategoryInfo : InvalidData: (:) [Split-Path], ParameterBindingV
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" alidationException
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAl
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" lowed,Microsoft.PowerShell.Commands.SplitPathCommand
07-17-2015 10:00:46.359 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd"
07-17-2015 10:00:49.024 +0200 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.244.224.81_8089_s0101954.de.db.com_S0101954_32D414DA-67CA-42A2-AFA2-4F581659353C
07-17-2015 10:00:49.026 +0200 INFO DC:HandshakeReplyHandler - Handshake done.
Hello,
any suggestions? - still have the same Issue.
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" l\GetXAApplicationReport6x.ps1:26 char:42
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + $ProcessName = (Split-Path -leaf ( $c[0] -replace '"','' ))
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" -replace ". ...
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + ~~~~~~~~~~~~~~~~~~~~~~~~~~
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + CategoryInfo : InvalidData: (:) [Split-Path], ParameterBindingV
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" alidationException
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAl
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd" lowed,Microsoft.PowerShell.Commands.SplitPathCommand
07-20-2015 11:10:17.635 +0200 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC\bin\powershell\GetXAApplicationReport6x.ps1'" -index xd"
cheers Nicolay
Looks like I need to add some more error checking to the script. For the most part, that error is indeed benign.
What is going on here is the script is trying to split out the command line executable on the published application to get only the executable name. For instance, if you have a command line executable like so:
c:\Program Files\foo\bar.exe
The script tries to get just "bar.exe" as the process name. The reason for this is there are some correlation dashboards that tie together information from perfmon to published applications. Perfmon only has the executable - not the published application name.
The script is written in such a way that this error will not stop the processing. Therefore, it is only not getting the $ProcessName for the published application causing the error. All the other information will be collected. So - yeah, kind of benign, but I'll get some better error checking in there.