https://community.splunk.com/t5/Monitoring-Splunk/logs-audit-db-delete-files-from-this-folder/m-p/57893#M655 <P>Check to see if the disk that Splunk uses for indexing is out of space. This will cause Splunk to stop indexing. <BR /> As the Splunk admin, look under <STRONG>Manager -&gt; System Settings -&gt; General Settings</STRONG> for the following values</P> <P><STRONG>Path to indexes</STRONG> - this is where the Splunk indexes are stored. From this, you should be able to tell which volume/disk is being used.</P> <P><STRONG>Pause indexing if free disk space falls below</STRONG> - this setting defines the minimum free disk space. If the free space on the disk/volume falls below this, Splunk will pause indexing.</P> <P>More information on these settings <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Changedefaultvalues">here</A> (Scroll to the last part of the page.)</P> <P>I believe this is probably what has happened here. But I could be wrong. How many files were <STRONG>in</STRONG> the /log/audit/db directory? What was the <STRONG>exact</STRONG> error message? (You can find it in <CODE>$SPLUNK_HOME/var/log/splunk/splunkd.log</CODE>)</P> Sat, 08 Dec 2012 19:15:06 GMT lguinn2 2012-12-08T19:15:06Z https://community.splunk.com/t5/Monitoring-Splunk/logs-audit-db-delete-files-from-this-folder/m-p/57892#M654 <P>Received some error that indexing is paused since /logs/audit/db/ was full of logs. Deleted some of the folders from /logs/audit/db/ to clear some space and now Splunkd does not start. Please assist in getting this working again. Thanks in advance.</P> Sat, 08 Dec 2012 04:36:01 GMT https://community.splunk.com/t5/Monitoring-Splunk/logs-audit-db-delete-files-from-this-folder/m-p/57892#M654 stevewong1290 2012-12-08T04:36:01Z https://community.splunk.com/t5/Monitoring-Splunk/logs-audit-db-delete-files-from-this-folder/m-p/57893#M655 <P>Check to see if the disk that Splunk uses for indexing is out of space. This will cause Splunk to stop indexing. <BR /> As the Splunk admin, look under <STRONG>Manager -&gt; System Settings -&gt; General Settings</STRONG> for the following values</P> <P><STRONG>Path to indexes</STRONG> - this is where the Splunk indexes are stored. From this, you should be able to tell which volume/disk is being used.</P> <P><STRONG>Pause indexing if free disk space falls below</STRONG> - this setting defines the minimum free disk space. If the free space on the disk/volume falls below this, Splunk will pause indexing.</P> <P>More information on these settings <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Changedefaultvalues">here</A> (Scroll to the last part of the page.)</P> <P>I believe this is probably what has happened here. But I could be wrong. How many files were <STRONG>in</STRONG> the /log/audit/db directory? What was the <STRONG>exact</STRONG> error message? (You can find it in <CODE>$SPLUNK_HOME/var/log/splunk/splunkd.log</CODE>)</P> Sat, 08 Dec 2012 19:15:06 GMT https://community.splunk.com/t5/Monitoring-Splunk/logs-audit-db-delete-files-from-this-folder/m-p/57893#M655 lguinn2 2012-12-08T19:15:06Z