topic KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log for de in Installation

KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log for de

rayar — Wed, 01 Dec 2021 15:15:12 GMT

I am getting

KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log for details.

I have stopped splunk and moved mongod folder and started it again

I am getting now

2021-12-01T13:55:55.528Z W CONTROL [main] net.ssl.sslCipherConfig is deprecated. It will be removed in a future release.
2021-12-01T13:55:55.545Z F NETWORK [main] The provided SSL certificate is expired or not yet valid.
2021-12-01T13:55:55.545Z F - [main] Fatal Assertion 28652 at src/mongo/util/net/ssl_manager.cpp 1120
2021-12-01T13:55:55.545Z F - [main]
***aborting after fassert() failure

and I want to regenerate server.pem

just to confirm this is the right command

$SPLUNK_HOME/bin/splunk createssl

what are the risks ?

Re: KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log fo

isoutamo — Wed, 01 Dec 2021 15:29:17 GMT

Here is an old post for this https://community.splunk.com/t5/Knowledge-Management/Can-you-help-me-with-the-following-mongod-kvstore-error/m-p/383335

Re: KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log fo

rayar — Wed, 01 Dec 2021 15:35:00 GMT

I have removed the server.pem and restarted the Splunk server and it didn't work

was not able to login Splunk

this is the reason I wanted to renew the server.pem manually

[splunk@ilissplsh01 bin]$ openssl x509 -enddate -noout -in /opt/splunk/etc/auth/server.pem
notAfter=Nov 17 08:28:40 2021 GMT
[splunk@ilissplsh01 bin]$

Re: KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log fo

isoutamo — Wed, 01 Dec 2021 16:36:45 GMT

Can you restore the mongod folder back to it’s original place and then try restart again without cert?

Re: KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log fo

rayar — Wed, 01 Dec 2021 17:17:11 GMT

I tried but it fails and I am getting

12-01-2021 19:06:26.395 +0200 WARN ConfigEncryptor - Invalid setting for server.conf/[general]/legacyCiphers
12-01-2021 19:06:26.395 +0200 ERROR ConfigEncryptor - server.conf/[general]/legacyCiphers is misconfigured.
12-01-2021 19:06:26.400 +0200 WARN ConfigEncryptor - Invalid setting for server.conf/[general]/legacyCiphers
12-01-2021 19:06:26.400 +0200 ERROR ConfigEncryptor - server.conf/[general]/legacyCiphers is misconfigured.
12-01-2021 19:06:26.400 +0200 WARN ConfigEncryptor - Invalid setting for server.conf/[general]/legacyCiphers
12-01-2021 19:06:26.400 +0200 ERROR ConfigEncryptor - server.conf/[general]/legacyCiphers is misconfigured.
12-01-2021 19:06:26.400 +0200 INFO ServerConfig - No '' certificate found. Splunkd communication will not work without this. If this is a fresh installation, this should be OK.

Re: KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log fo

isoutamo — Thu, 02 Dec 2021 07:12:19 GMT

After that restart splunk should create a new certificate. Can you validate it now with splunk cmd openssl command?

Re: KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log fo

rayar — Sun, 05 Dec 2021 06:06:46 GMT

I have resolved it working with Splunk support , some server.conf configuration was missing

we are still investigating

Re: KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log fo

Muwafi — Sun, 12 Jun 2022 02:19:51 GMT

Hello @rayar , have you solved this issue ? if so, would you please update us and post the solution here?

Thanks

Re: KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log fo

rayar — Sun, 12 Jun 2022 08:44:09 GMT

sorry its a very old issue I don't remember what was the solution