topic Re: Forwarder restarting every 10 minutes in Getting Data In

Forwarder restarting every 10 minutes

jihape — Mon, 09 Nov 2020 01:54:10 GMT

Hi,

I have a dozen of UFs that are restarting every ten minutes. They are on Windows. Running 7.2 (latest supported version).

What I have checked so far:

- Splunk excluded from antivirus
- disabled deploymentclient
- UF running as local system

Any ideas what could trigger a restart after disabling deploymentclient.conf?

nwuest — Mon, 09 Nov 2020 05:37:30 GMT

Just a thought, is there a file called “crash.log” in the following folder:

/opt/splunkforwarder/var/log/splunk/

If not, is there anything that is popping up in splunkd.log in the same folder?

Look forward to hearing from you!

V/R,
nwuest

jihape — Wed, 11 Nov 2020 00:35:42 GMT

Figured it out. Added some extra monitoring and found the server owner had a script that restarted the UF if it uses more than x memory 😂

Why he came to me with a problem he created I don't know.