topic Re: Splunk Universal Forwarder not starting after rebooting in Splunk Enterprise

Splunk Universal Forwarder not starting after rebooting

anh_nguyen — Thu, 12 Oct 2023 04:47:49 GMT

I've tried to enable boot-start on *nix and Windows, but after the machine reboots, Splunk Forwarder still cannot start automatically. Can anyone have solutions for this case?

Re: Splunk Universal Forwarder not starting after rebooting

richgalloway — Thu, 12 Oct 2023 12:50:50 GMT

Please tell us more. Were you successful at enabling boot-start? What command did you use? Did you do so as root? What errors are reported when the UF tries to start automatically?

Re: Splunk Universal Forwarder not starting after rebooting

anh_nguyen — Fri, 13 Oct 2023 03:49:39 GMT

For Ubuntu: I used the command

[sudo] $SPLUNK_HOME/bin/splunk enable boot-start

But when i rebooted the machine, I check the status of splunk forwader by using command ./splunk status. It returned "splunkd is not running".

For Windows: according to Splunk document, Splunk will run automatically after startup. But after restarting the machine, i checked in the Task Manager, the SplunkForwarder was not running.

Re: Splunk Universal Forwarder not starting after rebooting

SinghK — Fri, 13 Oct 2023 10:14:42 GMT

for windows the service status should be set to automatic for it to start on boot.

Re: Splunk Universal Forwarder not starting after rebooting

SinghK — Fri, 13 Oct 2023 10:16:12 GMT

and for Ubuntu when you try to start it manually does it start or gives the same errors?

Re: Splunk Universal Forwarder not starting after rebooting

isoutamo — Fri, 13 Oct 2023 10:47:19 GMT

When you have run that command have you gotten any error/warnigs?

Have you try this?

sudo -uroot bash $SPLUNK_HOME/bin/splunk enable boot-start -user splunk -systemd-managed 1

In current linux versions it's usually better to run splunk under systemd than old init.

But if you still want to use init then you must also update those startup scripts as this instructions said https://docs.splunk.com/Documentation/Splunk/9.1.1/Admin/ConfigureSplunktostartatboottime

r. Ismo

Re: Splunk Universal Forwarder not starting after rebooting

anh_nguyen — Mon, 16 Oct 2023 07:23:26 GMT

when I try to start splunk by command "./splunk start", it starts normally

Re: Splunk Universal Forwarder not starting after rebooting

anh_nguyen — Mon, 16 Oct 2023 07:37:22 GMT

I've tried the commands you suggested. But it still not work yet.

Re: Splunk Universal Forwarder not starting after rebooting

isoutamo — Mon, 16 Oct 2023 07:49:03 GMT

Base on this error message, it haven't removed /etc/init.d/splunk file. You should run again "disable" part and then check if that /etc/init.d/splunk file is there or not. If/when it's there, you must resolve the reason why it's here and remove it. Probably you have some hardening etc. on your system which cause this?

Re: Splunk Universal Forwarder not starting after rebooting

anh_nguyen — Thu, 26 Oct 2023 03:05:01 GMT

Finally, it works! Thank you very much.