https://community.splunk.com/t5/Getting-Data-In/Is-Splunk-UniversalForwarder-7-0-x-on-Windows-Server-2016/m-p/386264#M69333 <P>I ran into an issue on a Windows Server 2016 which is in company domain with <CODE>Splunk UF 7.0.7</CODE> version installed. When I install <CODE>Docker engine 17.06.2-ee-16</CODE>, I can't run any containers on the server. If I uninstall Splunk UF from the server, Docker runs fine and I can create/execute/remove containers just fine.</P> <P><STRONG>What I've discovered so far</STRONG><BR /> I prepped the VM per Docker docs (installed Containers feature) and got the engine installed and running. However, as soon as I try to start a container (e.g. <CODE>hello-world</CODE>), my Powershell console hangs and never returns control until I either kill <CODE>docker.exe</CODE> process or restart <CODE>docker service</CODE>.<BR /> If I kill <CODE>docker.exe</CODE> process and try to list containers (<CODE>docker ps -a</CODE>), the Powershell console hangs again. That's the behavior until I restart <CODE>docker service</CODE> on the server.<BR /> After restarting the service, I can list containers and see that a container I tried to run sometimes ends up with state <CODE>Created</CODE> and sometimes <CODE>Dead</CODE> but never in running state. If I try to start the container, Powershell console hangs again. If I try to remove the container, I get an error:<BR /> <CODE>Error response from daemon: driver "windowsfilter" failed to remove root filesystem for b3f.........: rename C:\ProgramData\docker\windowsfilter\b3f......... C:\ProgramData\docker\windowsfilter\b3f.........-removing: Access is denied.</CODE></P> <P>The only way to remove the container in limbo state is to reboot Windows server. After that I can remove the container but trying to run gets me into the same cycle.</P> <P>Since the issue gets resolved after Splunk UF is uninstalled, it appears to me that Splunk has something to do with the fact that Docker engine doesn't function properly. I configured Docker engine to run in <CODE>debug</CODE> mode but don't see any <CODE>errors</CODE> or <CODE>warnings</CODE> in its logs. Has anyone come across such issue? Any hints where I should look on Splunk config or logs side to get a sense of why it may hinder Docker engine?</P> Thu, 15 Nov 2018 19:24:17 GMT ivansha 2018-11-15T19:24:17Z https://community.splunk.com/t5/Getting-Data-In/Is-Splunk-UniversalForwarder-7-0-x-on-Windows-Server-2016/m-p/386264#M69333 <P>I ran into an issue on a Windows Server 2016 which is in company domain with <CODE>Splunk UF 7.0.7</CODE> version installed. When I install <CODE>Docker engine 17.06.2-ee-16</CODE>, I can't run any containers on the server. If I uninstall Splunk UF from the server, Docker runs fine and I can create/execute/remove containers just fine.</P> <P><STRONG>What I've discovered so far</STRONG><BR /> I prepped the VM per Docker docs (installed Containers feature) and got the engine installed and running. However, as soon as I try to start a container (e.g. <CODE>hello-world</CODE>), my Powershell console hangs and never returns control until I either kill <CODE>docker.exe</CODE> process or restart <CODE>docker service</CODE>.<BR /> If I kill <CODE>docker.exe</CODE> process and try to list containers (<CODE>docker ps -a</CODE>), the Powershell console hangs again. That's the behavior until I restart <CODE>docker service</CODE> on the server.<BR /> After restarting the service, I can list containers and see that a container I tried to run sometimes ends up with state <CODE>Created</CODE> and sometimes <CODE>Dead</CODE> but never in running state. If I try to start the container, Powershell console hangs again. If I try to remove the container, I get an error:<BR /> <CODE>Error response from daemon: driver "windowsfilter" failed to remove root filesystem for b3f.........: rename C:\ProgramData\docker\windowsfilter\b3f......... C:\ProgramData\docker\windowsfilter\b3f.........-removing: Access is denied.</CODE></P> <P>The only way to remove the container in limbo state is to reboot Windows server. After that I can remove the container but trying to run gets me into the same cycle.</P> <P>Since the issue gets resolved after Splunk UF is uninstalled, it appears to me that Splunk has something to do with the fact that Docker engine doesn't function properly. I configured Docker engine to run in <CODE>debug</CODE> mode but don't see any <CODE>errors</CODE> or <CODE>warnings</CODE> in its logs. Has anyone come across such issue? Any hints where I should look on Splunk config or logs side to get a sense of why it may hinder Docker engine?</P> Thu, 15 Nov 2018 19:24:17 GMT https://community.splunk.com/t5/Getting-Data-In/Is-Splunk-UniversalForwarder-7-0-x-on-Windows-Server-2016/m-p/386264#M69333 ivansha 2018-11-15T19:24:17Z