Getting Data In

Archive Signing

garima_chauhan
Path Finder

Hi,

I am using a script for archiving logs from colddb to a desired location. I have used the coldToFrozenExample.py script and basically just changed the archived location. The script works fine. However, since I intend to sign the bucket before archiving, I used the
signtool -s ARCHIVE_DIR
line in the script just before the bucket was to be copied to the location(as stated in the documentation). But, on doing so, the script doesnt work. Could it be the placement of signtool command? If so, please specify the exact location, as to where it should be placed. I am not familiar with python and hence, not able to spot the location.

Any help would be appreciated. Thanks in advance.

0 Karma

lguinn2
Legend

Each time the example coldToFrozen script runs, it archives a bucket by copying it. The destination directory is based on the combination of the ARCHIVE_DIR variable and the actual bucket name. To sign the bucket, you should add this line as the last line in the coldToFrozenExample.py file, keeping the same indentation as the line above it.

signtool --sign destdir

destdir is the variable containing the calculated destination path.

lguinn2
Legend

It should not go before the copy line. It should be indented exactly the same as the line before it. Also, use spaces or tabs - whichever was used in the line above.

Finally, check the ownership and permissions of the script that works. After you edit the script, does it have the same ownership and permissions? Perhaps you are changing something and that is why the script doesn't run.

0 Karma

garima_chauhan
Path Finder

I added the line signtool --sign destdir as the last line of the script and even before the copy line, but it did not work. The script doesnt run. If I remove the signtool line, it works fine. Please help

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...