topic Re: Why is a Splunk forwarder creating a zombie process when starting via systemd? in Deployment Architecture

Why is a Splunk forwarder creating a zombie process when starting via systemd?

rayrayrayray — Thu, 14 Feb 2019 16:05:44 GMT

I have installed version 7.2.4 of the Splunk Forwarder from the deb package on a x64 Ubuntu 18.04.1 LTS system. After the install, I used this command to generate the systemd unit file.

/opt/splunkforwarder/bin/splunk enable boot-start -user splunk --accept-license --no-prompt --answer-yes

The service starts and runs without any issue, but I'm always left with a zombie process on my system. If I stop the SplunkForwarder service, it goes away, and comes back when it's started again.

*USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
splunk 29920 0.0 0.0 0 0 ? Z 10:55 0:00 [systemctl] *

Does anyone know a way to get rid of this?

Re: Why is a Splunk forwarder creating a zombie process when starting via systemd?

ptcrusher — Mon, 20 May 2019 09:34:28 GMT

Were you able to sort it out? I'm facing the exact same issue

Thanks in advance

Re: Why is a Splunk forwarder creating a zombie process when starting via systemd?

rayrayrayray — Mon, 20 May 2019 15:09:44 GMT

I've upgraded to 7.2.6 and it looks like the issue is resolved.

Re: Why is a Splunk forwarder creating a zombie process when starting via systemd?

sreechallagundl — Mon, 20 May 2019 15:35:20 GMT

thanks ray... but why its coming, i didn't see any documentation from splunk GCS team, seems they even didn't bother about it...