topic Re: Can I force Splunk to drp core in a specific location? in Deployment Architecture

Can I force Splunk to drp core in a specific location?

matt — Tue, 17 Aug 2010 00:24:10 GMT

Is there a way to specify an alternate location for a Splunk forwarder to do its Splunk crash dumps?

Re: Can I force Splunk to drp core in a specific location?

Branden — Tue, 17 Aug 2010 00:42:10 GMT

I asked Splunk tech support this very question. They told me that Splunk will dump its core wherever the operating system specifies.

One recommendation someone had was to write a wrapper around the splunk binary. On our AIX system, it looks like this:

splunk.sh:

#!/bin/ksh

ulimit -c 0 #disable core dumps

exec /splunk/bin/splunk $1

The ulimit -c 0 option tells the operating system not to make a core dump. (Technically, it creates a core dump of 0 bytes in size, but it never seems to make an actual core file).

So when you start Splunk, you'd do: /splunk/bin/splunk.sh start

(Note: because of the $1, this only works for commands that have one parameter.)

The other option was to rename the splunk binary to splunk_real, then call the above shell script "splunk". That option didn't sit well with me, however.

Hope that helps!

Re: Can I force Splunk to drp core in a specific location?

pde — Tue, 17 Aug 2010 01:05:32 GMT

Yes, this is a function of the OS. In solaris, you use coreadm to instruct the system where to place core dump files. In the few versions of linux that I know anything about, it's a sysctl. You'll add, say, kernel.core_pattern=/var/core/core_%h_%e_%u_%g_%t_%p to /etc/sysctl.conf and reboot.

Re: Can I force Splunk to drp core in a specific location?

mzax — Wed, 18 Aug 2010 00:33:28 GMT

No. There is no way to tell splunk where to place the crash*.log files. You can control the location of some other log files from: $SPLUNK_HOME/etc/log.cfg More at: http://www.splunk.com/base/Documentation/latest/Admin/Splunklogfiles

Re: Can I force Splunk to drp core in a specific location?

gkanapathy — Wed, 18 Aug 2010 03:47:07 GMT

You can have your script pass all parameters by just changing $1 to $*

Re: Can I force Splunk to drp core in a specific location?

Branden — Wed, 18 Aug 2010 19:19:28 GMT

Nice tip, thanks!