topic Re: Search Head getting crashed in Splunk Enterprise

Search Head getting crashed

anandhalagarasa — Fri, 03 Aug 2018 10:59:27 GMT

Our Primary search head got crashed twice today. When cross verified we found out this is the error message in Crash.log so how should we need to fix it asap.

Error Message:
Received fatal signal 6 (Aborted).
Cause:
Signal sent by PID xxx36 running under UID 99xx.
Crashing thread: IdataDO_Collector

Re: Search Head getting crashed

deepashri_123 — Fri, 03 Aug 2018 11:27:42 GMT

Hey@anandhalagarasan,

What version of splunk are you using?

Re: Search Head getting crashed

jkat54 — Fri, 03 Aug 2018 11:33:03 GMT

See if this helps:
https://answers.splunk.com/answers/330827/after-upgrade-from-62-to-63-unable-to-start-splunk.html

vranjith009 · Dec 07, 2015 at 10:25 PM
Thanks mfrost8 for your reply.

Error was due to some permission issue of audit db files and "indexes.conf" . Given splunk:splunk permission to all audit db buckets and tracing of bad index conf file by using "./splunk cmd btool indexes list --debug|more" help us for closing the issue.

Re: Search Head getting crashed

anandhalagarasa — Fri, 03 Aug 2018 13:08:54 GMT

Splunk 6.5.0 (build 59c8927def0f)

Re: Search Head getting crashed

sudosplunk — Fri, 03 Aug 2018 14:32:06 GMT

Hi there,
Just making sure, did you check the following conditions,

Having enough disk space - For linux,du -sh $SPLUNK_HOME/
Any user running expensive searches - If you've configured Monitoring console, you can navigate to search -> Activity -> Search Activity: Instance OR go to Jobs Manager page.