splunkweb arbitrary crashing

aphextwin — Mon, 28 Sep 2020 11:31:09 GMT

Hi Folks
Been scratching my head on this....any help is appreciated!

Issue:
splunkweb crashes for unknown reason at random times. usually happens when a new login session is initiated

Some background:
Splunk version -4.3 build 115073
OS: Mac OS 10.6 Server
Setup: Windows heavy-forwarder sending to MacOSX indexer. HTTP running only on indexer.

web_service.log:
2012-03-15 11:53:21,934 INFO [4f6167b1ee72e1c70] decorators:321 - require_login - no splunkd sessionKey variable set; cherrypy_session=1562893fce4233c5947f6dd9cf1b53c434f8f279 request_path=/en-US/
2012-03-15 11:53:21,934 INFO [4f6167b1ee72e1c70] decorators:328 - require_login - redirecting to login
2012-03-15 11:53:28,617 INFO [4f6167b88a2aafb90] account:209 - user=XXXXXXXX action=login status=success session=9966eadb5d6bd2051ea9a8f6bc63c160 reason=user-initiated useragent="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; MS-RTC LM 8; InfoPath.2; .NET4.0E; Zune 4.7)" clientip=10.176.5.193
2012-03-15 11:53:28,648 INFO [4f6167b8a57a431f0] cached:77 - memoized decorator used on function with non hashable arguments
2012-03-15 11:53:28,779 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "search_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "search_detail_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "search_user_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "search_ui_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "index_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "index_status_health" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "indexing_volume" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "splunkd_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "splunkweb_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "inputs_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "scheduler_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,782 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "scheduler_user_app" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,782 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "scheduler_savedsearch" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,782 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "scheduler_status_errors" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,782 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "pdf_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,793 INFO [4f6167b8ca2aafdd0] cached:77 - memoized decorator used on function with non hashable arguments
2012-03-15 11:53:28,885 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "search_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,885 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "search_detail_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "search_user_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "search_ui_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "index_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "index_status_health" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "indexing_volume" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "splunkd_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "splunkweb_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "inputs_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "scheduler_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "scheduler_user_app" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,888 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "scheduler_savedsearch" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,888 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "scheduler_status_errors" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,888 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "pdf_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:29,034 INFO [4f6167b8ca2aafdd0] view:1056 - PERF - viewTime=0.0981s templateTime=0.143s
2012-03-15 11:53:29,187 ERROR [4f4a50173e17af970] root:133 - ENGINE: Error in HTTP server: shutting down
Traceback (most recent call last):
File "/Applications/splunk/lib/python2.7/site-packages/cherrypy/process/servers.py", line 73, in start_http_thread
self.httpserver.start()
File "/Applications/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/init.py", line 1692, in start
self.tick()
File "/Applications/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/init.py", line 1745, in tick
s, addr = self.socket.accept()
File "/Applications/splunk/lib/python2.7/ssl.py", line 347, in accept
suppress_ragged_eofs=self.suppress_ragged_eofs),
File "/Applications/splunk/lib/python2.7/ssl.py", line 121, in __init_
socket.getpeername(self)
File "/Applications/splunk/lib/python2.7/socket.py", line 224, in meth
return getattr(self._sock,name)(*args)
error: [Errno 22] Invalid argument

Re: splunkweb arbitrary crashing

melting — Fri, 30 Mar 2012 19:17:32 GMT

Looks like CherryPy is having trouble when sockets are closed unexpectedly. Thanks for letting us know. If you continue to have this problem I would suggest filing a case with support.

topic Re: splunkweb arbitrary crashing in Security

splunkweb arbitrary crashing

Re: splunkweb arbitrary crashing