[Known issue] Compatibility issue of UCC library with Python 3.9 that might cause Splunk crash

[artemrys]

Description

Overview

The UCC engineering team discovered that some technology add-ons that use UCC (specifically splunktaucclib) might have a compatibility issue with Python 3.9 (running modular input will crash and might cause Splunk to crash as well).

splunktaucclib (https://github.com/splunk/addonfactory-ucc-library) is a Python library that is a part of the UCC framework ecosystem and used in all UCC-based technology add-ons. It provides out-of-the-box REST handler support for technology add-ons.

Historically, it has included one module for data collection. The team discovered that disabling the stdout buffer doesn't work for Python 3.9 (the fix was released as part of the 6.2.2 version). At the same time, the functionality works for Python version 3.7 and versions greater than 3.10. The problem can be reproduced with pure Python code without the technology add-on’s code. As a solution, the engineering team removed the disabling buffer and decided to flush buffers immediately.

How to know whether your TA is impacted

A customer of technology add-ons might encounter a critical issue if all the following conditions are met:

• The customer uses Splunk with Python 3.9 enabled
• Splunk Enterprise 9.3.x
• Splunk Cloud 9.2.2403
• splunktaucclib version lower than v6.2.2 is used
  • splunktaucclib.data_collection.ta_mod_input module is used to run the modular input

Resolution steps

The fix is to update splunktaucclib to at least the 6.2.2 version and release a new version of the technology add-on.

What UCC version are you using?

N/A

Additional System Info

All