topic Re: Can run splunkd in foreground? in Monitoring Splunk

Can run splunkd in foreground?

hochit — Wed, 28 Nov 2012 16:37:23 GMT

Some integration reason I need to run application in foreground by another agent in my company.
Is it a way to run Splunk in foreground?

Re: Can run splunkd in foreground?

MHibbin — Wed, 28 Nov 2012 16:54:04 GMT

Perhaps more details of the scenario would help...

Re: Can run splunkd in foreground?

hochit — Thu, 29 Nov 2012 01:33:19 GMT

Nothing special actually. I just want to know if I can run Splunk in foreground instead of daemon. Like most of the other applications that we can make the choice

Re: Can run splunkd in foreground?

Linegod — Thu, 29 Nov 2012 01:36:31 GMT

You're really not explaining why you want to run it in the foreground. What is the actual problem you are attempting to solve, that you think having splunkd in the foreground would help?

Re: Can run splunkd in foreground?

hochit — Thu, 29 Nov 2012 01:41:52 GMT

There's a application management agent from my company that would start/stop app and monitor the process status actively. They're using it to run application into background mode. As I know if Splunk is in background already, somehow it would lose control of the process.

Re: Can run splunkd in foreground?

Linegod — Thu, 29 Nov 2012 01:46:47 GMT

Are you sure the application management agent cannot accept the fact that the app goes into daemon mode on its own, and simply issue the 'restart' option if the process dies?

Re: Can run splunkd in foreground?

hovu96-deactiva — Tue, 18 Dec 2012 23:10:16 GMT

Did you find a solution or workaround to do this?

Re: Can run splunkd in foreground?

hochit — Wed, 19 Dec 2012 01:19:13 GMT

I asked splunk support. Nothing we can do about this.

Re: Can run splunkd in foreground?

amrit — Mon, 15 Apr 2013 16:55:28 GMT

Easy: splunk start splunkd --nodaemon

Re: Can run splunkd in foreground?

luhadia_aditya — Thu, 18 Feb 2016 09:17:26 GMT

How stable splunkd is in foreground. As such there is no official documentation stating this parameter.

I have faced such scenarios, if you may suggest something -
https://answers.splunk.com/answers/189019/why-splunkd-is-exiting-with-retrun-code-2-when-run.html

Re: Can run splunkd in foreground?

jrodman — Thu, 14 Apr 2016 08:40:02 GMT

Indeed, --nodaemon involves a few changes in behavior, such as not changing the current directory (to /), which means the current directory of splunkd will be whatever you launched it with, safe or not. You won't be happy if you unmount the filesystem splunkd has as a current directory, for example.

We also do not QA splunkd with this flag. It's intended for testing, troubleshooting and development.

Re: Can run splunkd in foreground?

jrodman — Thu, 14 Apr 2016 08:41:23 GMT

I downvoted this post because this is not an advisable recommendation for production use.

Re: Can run splunkd in foreground?

corydodt — Mon, 20 Jun 2016 23:03:31 GMT

But why not?

This should be the best-supported way to run splunk. All standard linux pid-1 inits work better with foreground processes because it's easy to detect when the process has exited. You have to go to considerable trouble to make them monitor background processes correctly.

I'm still getting over the fact that splunk doesn't actually ship with any sysvinit-style (or upstart or sysctld...) init scripts.