topic Splunk web can not start in Security

Splunk web can not start

whitelord90 — Thu, 05 May 2011 08:50:36 GMT

Hello,
For some reason, splunkweb fails to start in first, my version is 4.2.1 any ideas where i can look for to troubleshoot:

This appears to be your first time running this version of Splunk.
Copying '/opt/splunk/etc/openldap/ldap.conf.default' to '/opt/splunk/                       etc/openldap/ldap.conf'.
Generating RSA private key, 1024 bit long modulus
............++++++
...............++++++
e is 65537 (0x10001)
writing RSA key

Generating RSA private key, 1024 bit long modulus
........................++++++
.......................................++++++
e is 65537 (0x10001)
writing RSA key

Moving '/opt/splunk/share/splunk/search_mrsparkle/modules.new' to '/o                       pt/splunk/share/splunk/search_mrsparkle/modules'.

Splunk> CSI: Logfiles.

Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking configuration...  Done.
        Checking index directory...
        Creating: /opt/splunk/var/lib/splunk
        Creating: /opt/splunk/var/lib/splunk/appserver/i18n
        Creating: /opt/splunk/var/lib/splunk/appserver/modules/static                       /css
        Creating: /opt/splunk/var/run/splunk
        Creating: /opt/splunk/var/run/splunk/upload
        Creating: /opt/splunk/var/spool/splunk
        Creating: /opt/splunk/var/spool/dirmoncache
        Creating: /opt/splunk/var/lib/splunk/authDb
        Creating: /opt/splunk/var/lib/splunk/hashDb
        Validated databases: _audit _blocksignature _internal _thefis                       hbucket history main summary
        Done
New certs have been generated in '/opt/splunk/etc/auth'.
Success
        Checking conf files for typos...
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
                                                           [  OK  ]
Done.Starting splunkweb... /opt/splunk/etc/auth/splunkweb does not ex                       ist. Will create
Generating certs for splunkweb server
Generating a 1024 bit RSA private key
.....++++++
...........................++++++
writing new private key to 'privKeySecure.pem'
-----
Signature ok
subject=/CN=xxx.xxx@xxx/O=SplunkUser
Getting CA Private Key
writing RSA key
Error starting splunkweb.                                  [FAILED]

I read topic: http://www.splunk.com/support/forum:SplunkAdministration/2625

I have startwebserver = 1 in /opt/splunk/etc/system/local/web.conf. Please help me.
Thanks

Re: Splunk web can not start

jbsplunk — Mon, 28 Sep 2020 09:31:56 GMT

Are you seeing any errors in your web_service.log or splunkd.log files inside of $SPLUNK_HOME/var/log/splunk at the time when you see this failure?

If so, it would be a good idea to edit your post to include what you are seeing in those files.

Re: Splunk web can not start

proctorgeorge — Thu, 05 May 2011 17:41:59 GMT

Have you recently upgraded to v4.2.1 from a previous Splunk version?

I had a similar problem when I upgraded with the wrong user account (a different one then I used to originally install).

Re: Splunk web can not start

whitelord90 — Mon, 28 Sep 2020 09:32:25 GMT

Thanks your help,
In web_service.log, i have some error:
+355 ERROR[4dc6c00e22a47ffcc] root:133 - ENGINE: Error in 'start' listener >
+357 ERROR[4dc6c00e22a47ffcc] custompidfile:43 - Unable to remove /opt/splunk/var/run/splunk/splunkweb.pid. [[Errno 2] No such file or directory: '/opt/splunk/var/run/splunk/splunkweb.pid']
+,357 ERROR[4dc6c00e22a47ffcc] root:493 - Unable to start splunkweb
+358 ERROR[4dc6c00e22a47ffcc] root:494 - can't start new thread
my log in : http://www.mediafire.com/?4b0c6e6svrb68z7

Re: Splunk web can not start

whitelord90 — Sun, 08 May 2011 16:25:22 GMT

NO, I am completely new installation. Maybe my OS lost some lib or something... 😞