topic Re: Is there a way in splunk 7.2.* to auto restart after crashing? in Deployment Architecture

Is there a way in splunk 7.2.* to auto restart after crashing?

sarit_s — Tue, 30 Apr 2019 17:38:24 GMT

Hello

Is there a way in splunk 7.2.* to auto restart after crushing ?

i read this article :
https://docs.splunk.com/Documentation/Splunk/7.2.2/Admin/RunSplunkassystemdservice#Configure_systemd_using_enable_boot-start
but for some reason i cant find any of this files in my system

Any suggestions?

Re: Is there a way in splunk 7.2.* to auto restart after crashing?

codebuilder — Tue, 30 Apr 2019 17:52:39 GMT

It depends on your version of Linux and whether it's using systemd.

For RHEL/Centos 7.x (systemd):
systemctl enable splunk

For RHEL/Centos 6.x and below (non-systemd):
chkconfig splunk on

Though deprecated, chkconfig will still work on systemd, but the opposite is not true.

Re: Is there a way in splunk 7.2.* to auto restart after crashing?

sarit_s — Tue, 30 Apr 2019 17:58:47 GMT

i found the files.. just looked at the wrong place:)

looks like it is configured as expected but still im not sure splunk is recovered well after crushing

stopping splunk manually is a good way to check if its automatically restarts?
if yes then im sure it is not working 🙂

Re: Is there a way in splunk 7.2.* to auto restart after crashing?

codebuilder — Tue, 30 Apr 2019 18:16:18 GMT

Both commands apply only to configuring Splunk to start after a reboot, not a crash.

Re: Is there a way in splunk 7.2.* to auto restart after crashing?

sarit_s — Tue, 30 Apr 2019 18:21:30 GMT

oh, ok.
how can i auto start splunk after crush ?

Re: Is there a way in splunk 7.2.* to auto restart after crashing?

codebuilder — Tue, 30 Apr 2019 18:34:58 GMT

It should come preconfigured to do so, but you can add Restart=always to the splunk unit file.

Example:

[Unit] Description=Systemd service
file for Splunk, generated by 'splunk
enable boot-start'
After=network.target

[Service] Type=simple Restart=always

Then reload the config:

systemctl daemon-reload

Re: Is there a way in splunk 7.2.* to auto restart after crashing?

sarit_s — Tue, 30 Apr 2019 18:44:59 GMT

it is already conifgured
how can i validate it is working ?

Re: Is there a way in splunk 7.2.* to auto restart after crashing?

codebuilder — Tue, 30 Apr 2019 18:52:37 GMT

Find the PID of your splunk daemon:

ps -ef |grep -i splunk

Then kill that process:

kill -9 pid_of_splunk_daemon

Wait a few seconds then re-run the ps command to verify it comes back up:

ps -ef |grep -i splunk

Note that if you really want to test this, it should be on a DEV or non-critical box.

Re: Is there a way in splunk 7.2.* to auto restart after crashing?

sarit_s — Tue, 30 Apr 2019 18:58:57 GMT

thanks !
Splunk system is not production yet but just to be on the safe side - something bad can happen if i will kill the process ?

Re: Is there a way in splunk 7.2.* to auto restart after crashing?

codebuilder — Tue, 30 Apr 2019 19:15:53 GMT

Nothing bad will happen, it is just not a graceful way to bring down a process. So I was adding my disclaimer, just in case 🙂

Re: Is there a way in splunk 7.2.* to auto restart after crashing?

sarit_s — Tue, 30 Apr 2019 19:17:52 GMT

thank you very much !

Re: Is there a way in splunk 7.2.* to auto restart after crashing?

codebuilder — Tue, 30 Apr 2019 19:23:28 GMT

Glad to help.