topic Re: SplunkWeb Issues in Security

SplunkWeb Issues

markes1 — Tue, 30 Nov 2010 09:40:48 GMT

I am running Ubuntu 10.04 on an i386 machine.

I get this output:

steve@steve-laptop:/opt/splunk/bin$ sudo ./splunk start [sudo] password for steve: splunkd 5067 was not running. Stopping splunk helpers...

Done. Stopped helpers. Removing stale pid file... done.

Splunk> 4TW

Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking configuration... Done. Checking index directory... Done. Checking databases... Validated databases: _audit, _blocksignature, _internal, _thefishbucket, history, main, sample, summary All preliminary checks passed.

Starting splunk server daemon (splunkd)... Done. Starting splunkweb... Error starting splunkweb. steve@steve-laptop:/opt/splunk/bin$

I have checked web.conf, and that is set. I checked permissions, and they seem to be set too.

Any ideas or thoughts on what I should check next?

Take care.

Steve

Re: SplunkWeb Issues

mw — Tue, 30 Nov 2010 11:10:28 GMT

What happens if you run: splunk restart splunkweb

Also, anything obvious in $SPLUNK_HOME/var/log/splunk/web_service.log ?

Re: SplunkWeb Issues

markes1 — Thu, 02 Dec 2010 00:18:04 GMT

So, I renamed the "Modules" directory from "Modules.new" as I have residual files from an old Splunk installation on my machine.

SplunkWeb is still acting up, and the web_service.log is showing the following snippet of interest:

2010-12-01 11:05:55,955 WARNING [4cf6726329a3242cc] custompidfile:36 - Removing pidfile at /opt/splunk/var/run/splunk/splunkweb.pid (PID: 1796)"
2010-12-01 11:05:55,955 ERROR [4cf6726329a3242cc] custompidfile:42 - Unable to remove /opt/splunk/var/run/splunk/splunkweb.pid. [[Errno 2] No such file or directory: '/opt/splunk/var/run/splunk/splunkweb.pid']

Any ideas?

Re: SplunkWeb Issues

mw — Thu, 02 Dec 2010 03:15:39 GMT

Which modules directory? I would expect Errno 2 on shutdown of splunkweb if it never started correctly. Is splunk running as a non-root user, by chance?