When the following Error appears on IOP, there are 4 possible reasons:
- License Violation - Easy to review, compare their current license with the current usage. Check Introspection report for last few days that it won't pass the actual license, for example, see image below, if the actual license is 200mb it means you are violating it. To check which license you have, go to licenses in Insights (Admin -> Licenses).
Props.conf browserurl Issue - Open the props.conf file located <C:\Program Files\Smart-X\ControlUp Insights\etc\apps\controlup_iop\default> or where your insights install is located.
Replace the line that reads (should be at line ~682)
sourcetype = cuiop:browserurl:header
sourcetype = cuiop:aux2
Or, Just use the props.conf file attached below.
- Index of CSV files - verify that IOP is not indexing anything else rather than something that starts with "cuiop", we had some cases where customers had some CSV files in the activity files folder, that causes a violation.
For example, see image below, the CSV part caused a repeated license violation (roughly 24 hours after the reset license has expired).
Another option will be to go to the IOP search (Top left corner) and type:
|tstats count by sourcetype change it to search last 24 hours.
That will give us the sourcetypes that IOP has indexed and will tell us what type of file is the problematic one. send firstname.lastname@example.org a screenshot of the search.
On-Premises customers who have upgraded to ControlUp v7.1.x and IOP v3.x may see occasional 'tstats' errrors.
This may be caused by the presence of files named "in_root_folder" in their IOP Activity Files share that is being ingested by the IOP engine.
All On-Premises customers on v7.1.x should implement the solution in this article