Splunk DB Connect 2 ConfPathMapper and ExecProcessor Errors

[rmsit]

Hi, all.

I receiving the following errors in Splunk after enabling several database inputs which do work. I have reinstalled the latest app version with the same results. Any ideas on the cause?

05-30-2016 15:46:09.929 -0400 ERROR ExecProcessor - message from "python "D:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" Degrade mode - ENTERING - (pid=8512) rename failed. File in use? exception=[Error 32] The process cannot access the file because it is being used by another process

05-30-2016 15:46:09.686 -0400 ERROR ExecProcessor - message from "python "D:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" Degrade mode - ENTERING - (pid=4804) rename failed. File in use? exception=[Error 32] The process cannot access the file because it is being used by another process

05-30-2016 15:46:08.902 -0400 ERROR ConfPathMapper - ConfPathMapper: D:\Program Files\Splunk\etc\apps\splunk_app_db_connect\local: Refused forced reload of inputs.conf: outstanding write

Thank you

[Muryoutaisuu]

I opened a case because of this.

It seems the message is logged with wrong loglevel. It should be warning instead of error. (information from support)
The Problem is caused by too many checkpoint value updates. If you have several db inputs with a lot of data, but a very small fetch size, it will be updated a lot, thus causing write locks on the inputs.conf file.

Try to balance the fetch size, interval and the JVM Heapsize (tip from splunk support)

Background information: The checkpoint value from each db input is saved in memory. On update it is written to the inputs.conf file. If the inputs.conf file is locked, the checkpoint value in inputs.conf will not be updated. splunkd will try to update the checkpoint value on next update.
I suspect, if splunkd were to crash before writing the updated checkpoint to inputs.conf, it might cause duplicate events on next db input run. NOT CONFIRMED

Kind regards
Muryoutaisuu

[ehudb]

Hello
Did you find a solution for this error?

[rmsit]

I did not. Splunk support recommended I upgrade to the latest app version, which I did, but I still saw the errors. I did notice the file system permissions (for me Windows) were not consistent throughout the app's subdirectories which resolve the other issue I was having with files in /local not being read.

Hope this helps...