topic Re: unable start forwarder in Deployment Architecture

unable start forwarder

st88 — Thu, 27 May 2021 22:10:35 GMT

i can't start forwarder i take this error:

Starting splunk server daemon (splunkd)...
SplunkForwarder: Unable to start the service: Access is denied.

Re: unable start forwarder

richgalloway — Fri, 28 May 2021 00:21:14 GMT

Verify the files are owned by the right user. Confirm you are starting Splunk as that user.

For more suggestions, tell us more about the problem. Is this a fresh installation? Has it ever worked? What platform? How was the forwarder installed? How are you trying to start it?

Re: unable start forwarder

st88 — Fri, 28 May 2021 07:25:31 GMT

Yes it is first installation on windows virtual box on windows host, also it has never worked. I installed from gui installer and i am truing to start by splunk start or splunk restart on command line and i get the following:

Checking prerequisites...
Checking mgmt port [9089]: open
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from 'C:\Program Files\SplunkUniversalForwarder\splunkforwarder-8.2.0-e053ef3c985f-windows-64-manifest'
All installed files intact.
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
SplunkForwarder: Unable to start the service: Access is denied.

Re: unable start forwarder

st88 — Fri, 28 May 2021 07:32:53 GMT

How can i verify the files are owned by the right user and start splunk from this user?

Re: unable start forwarder

richgalloway — Fri, 28 May 2021 14:12:18 GMT

Yeah, that was more of a Linux answer than a Windows answer. Sorry about that.

I wonder if maybe the virtualization is causing the problem. Have you tried installing the forwarder directly on the host system? Why not use a Linux VM?

Re: unable start forwarder

SamHTexas — Mon, 07 Jun 2021 20:52:31 GMT

Not sure if the management port you have listed above 9089 is correct. I have used 8089 for the longest time.

Re: unable start forwarder

splnkuserav — Sat, 19 Jun 2021 21:00:49 GMT

I am seeing same error. Did this ever get resolved?

Thanks!