topic splunkweb will not stop in Security

splunkweb will not stop

hharvey — Wed, 12 Oct 2011 12:57:56 GMT

Can't get to the web UI and during restart we are getting



Timed out waiting for splunkweb to stop.                   [FAILED]

And then during startup:



splunkweb is already running.                              [FAILED]

trying to restart splunkweb returns the same errors.

Can find lots of info about splunkweb NOT starting, but not much on a timed out shutdown. Any suggestions? web_service.log shows the following:

2011-10-11 22:52:12,933 ERROR   [4e9500dced2aaaaccb4710] utility:59 - name=javascript, class=Splunk.Error, lineNumber=0, message=uncaught exception: [Exception... "Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIXMLHttpRequest.status]"  nsresult: "0x80040111 (NS_ERROR_NOT_AVAILABLE)" location: "JS frame :: https://10.20.72.89:8000/enUS/static/@101277.2/js/common.min.js ::  :: line 13066"  data: no], fileName=
2011-10-11 22:59:16,043 ERROR   [4e9502840a2aaaaccc8550] utility:59 - name=javascript, class=Splunk.Error, lineNumber=8234, message=response is null, fileN                         ame=https://10.20.72.89:8000/en-US/static/@101277.2/js/common.min.js
2011-10-12 08:21:50,861 INFO    [4e94386bc81a2b2550] root:133 - ENGINE: Caught signal SIGTERM.
2011-10-12 08:21:50,861 INFO    [4e94386bc81a2b2550] root:133 - ENGINE: Bus STOPPING

Re: splunkweb will not stop

Drainy — Wed, 12 Oct 2011 13:22:27 GMT

Bit of a wild one this but do a splunk stop, followed with;

ps x | grep splunk

At the start of each row is the PID of the app, type;

kill -9 PID

This will then kill the instance. I would be tempted to kill each splunk entry (the web one should start with python -O and then the rest of the name lists off into the Splunk directory.

This is a bit of a hack and a slash method however, once done try starting it up again.
If that fails it might be the lock file (If I remember this correctly) and it may not be getting cleared or it may have been created by a user of a higher level and splunk is now having a fit when trying to start.

Note: this assumes linux 🙂

Re: splunkweb will not stop

hharvey — Wed, 12 Oct 2011 13:38:05 GMT

this did it - thanks!

Re: splunkweb will not stop

Drainy — Wed, 12 Oct 2011 14:12:19 GMT

no probs 🙂