topic Re: Forwarder not starting in Getting Data In

Forwarder not starting

ramprakash — Tue, 02 Jul 2019 13:31:58 GMT

I have forwarder down since past two months, when i brought it up it generated errors.

No Splunkd logs have been created. I understand that Ulimit is not set as per Splunk documentation but it should start at least.
If someone can let me know what is the possible issue of Forwarder not starting.

Checking prerequisites...
WARNING: Data segment size limit (ulimit -d) is set low (134217728 bytes) Splunk may not work.
You may want to run "ulimit -d unlimited" before starting splunk.
WARNING: Resident memory size limit (ulimit -m) is set low (33554432 bytes) Splunk may not work.
You may want to run "ulimit -m unlimited" before starting splunk.
WARNING: File size limit (ulimit -f) is set low (1073741312 bytes) Splunk may not work.
You may want to run "ulimit -f unlimited" before starting splunk.
Checking mgmt port [8089]: open
Assertion failed: _linkp == nullptr, file /home/build/build-src/orangeswirl/src/util/TimeoutHeap.cpp, line 46
Dying on signal #6 (si_code=0), sent by PID 0 (UID 0). Attempting to clean up pidfile
ERROR: pid 5702028 terminated with signal 6
SSL certificate generation failed.

Re: Forwarder not starting

jimmytpowers — Tue, 02 Jul 2019 20:06:56 GMT

Hello,

Save a copy of inputs.conf from the current instance, re-install the forwarder and place the saved copy of inputs.conf in the correct directory.

I would also adjust the Ulimits to the recommended settings.

Cheers,

Re: Forwarder not starting

ramprakash — Tue, 02 Jul 2019 20:28:22 GMT

Thanks for the suggestion. Can i install Splunk on some other directory and copy all the configurations?

Re: Forwarder not starting

jimmytpowers — Tue, 02 Jul 2019 21:21:03 GMT

Yes, and you can delete the old forwarder directory once you apply all the old configs to the new, and get the data forwarding to indexers.

Re: Forwarder not starting

ramprakash — Tue, 02 Jul 2019 21:29:51 GMT

Thanks much i will do it and update you if it works..

Meanwhile i have some doubt on server.conf of old forwarder. This forwarder was installed by someone else and it has sslPassword stanza with some values. How can we get this value or it geneartes automatically when we install forwarder.

Re: Forwarder not starting

jimmytpowers — Tue, 02 Jul 2019 21:37:49 GMT

It can generate certs by default, and they expire after 3 years.

https://docs.splunk.com/Documentation/Splunk/7.3.0/Security/Aboutsecuringdatafromforwarders