All Apps and Add-ons

ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/interfaces.sh" cat: /sys/class/net/eth#/speed: Invalid argument

jlstanley
Path Finder

Getting error on many servers about :
ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/interfaces.sh" cat: /sys/class/net/eth7/speed: Invalid argument
the nic with vary so it' s not always eth7.

anyone know how to fix offhand?

nunoaragao
Explorer

cat: /sys/class/net/eth7/speed: will return Invalid argument if the NIC is disconnected. Same for duplex.
The way I fixed this, was to previously check if the state is "Up", like this

if [ -r /sys/class/net/$iface/duplex ]; then
         if grep -Fq "up" /sys/class/net/$iface/operstate; then
                     DUPLEX=`cat /sys/class/net/$iface/duplex | sed 's/./\u&/'`
                     [ .... more original code here .... ]
         fi

Other lines of code might also do the trick

0 Karma

jlstanley
Path Finder

I'm wondering if the version 7 of the add-on for Unix and Linux fixes it? if not, I'll give this a try. thanks

0 Karma

esalesapns2
Path Finder

My interface is showing "up", but I'm getting errors for "speed" and "duplex", even if I cat them from the command line; I'm running on a fairly recent Splunk AMI in AWS, One wonders why Splunk hasn't seen/fixed this?

0 Karma

nunoaragao
Explorer

I've hit the same snag on some AMI on AWS. Could not figure out an elegant solution, so I've resorted to:
DUPLEX=cat /sys/class/net/$iface/duplex 2>/dev/null | sed 's/./\u&/'
...
SPEED=cat /sys/class/net/$iface/speed 2>/dev/null

Which redirects the errors to dev null. That was Splunk's implementation back on version 5 of the add-on.

0 Karma

wfrankl2
Explorer

I get the same thing but not just for speed. duplex and docker0

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...