The issue is the permissions of the file: lib/splunklib/modularinput/event_writer.py `-rwxr-xr-x 1 user None 2878 Sep 22 20:09 event_writer.py ` So 755 will not pass appinspect, this file should be 644 like all the other files...