https://community.splunk.com/t5/Monitoring-Splunk/OSSEC-and-SPLUNK-just-stopped/m-p/15765#M6749 <P>I've had both services running on the save Ubuntu 10.04 server for about a week. OSSEC is cooking along gathering information. And SPLUNK is happily displaying this data for easy quick high level viewing.</P> <P>I did switch SPLUNK to the "free" license.</P> <P>For days &amp; days I've had good data. @ around noon yesterday, it started to taper DOWN...</P> <P>06-18-2010 05:59:55.073 INFO Metrics - group=per_source_thruput, series="udp:10002", kbps=2.371535, eps=3.741935, kb=73.517578 host=lcua141 Options| sourcetype=splunkd Options| source=/opt/splunk/var/log/splunk/metrics.log Options</P> <P>I noticed today @ 6am data stopped. This was the last entry... </P> <P>6/18/10 6:00:26.048 AM<BR /> 06-18-2010 06:00:26.048 INFO Metrics - group=per_source_thruput, series="udp:10002", kbps=2.371220, eps=4.258065, kb=73.507812 host=lcua141 Options| sourcetype=splunkd Options| source=/opt/splunk/var/log/splunk/metrics.log Options</P> <P>I'll start by looking at this splunk log... </P> <P>Any suggestions/ideas appreciated!</P> <P>Thank you! </P> <P>JLH </P> Fri, 18 Jun 2010 21:32:47 GMT jhuebner 2010-06-18T21:32:47Z https://community.splunk.com/t5/Monitoring-Splunk/OSSEC-and-SPLUNK-just-stopped/m-p/15765#M6749 <P>I've had both services running on the save Ubuntu 10.04 server for about a week. OSSEC is cooking along gathering information. And SPLUNK is happily displaying this data for easy quick high level viewing.</P> <P>I did switch SPLUNK to the "free" license.</P> <P>For days &amp; days I've had good data. @ around noon yesterday, it started to taper DOWN...</P> <P>06-18-2010 05:59:55.073 INFO Metrics - group=per_source_thruput, series="udp:10002", kbps=2.371535, eps=3.741935, kb=73.517578 host=lcua141 Options| sourcetype=splunkd Options| source=/opt/splunk/var/log/splunk/metrics.log Options</P> <P>I noticed today @ 6am data stopped. This was the last entry... </P> <P>6/18/10 6:00:26.048 AM<BR /> 06-18-2010 06:00:26.048 INFO Metrics - group=per_source_thruput, series="udp:10002", kbps=2.371220, eps=4.258065, kb=73.507812 host=lcua141 Options| sourcetype=splunkd Options| source=/opt/splunk/var/log/splunk/metrics.log Options</P> <P>I'll start by looking at this splunk log... </P> <P>Any suggestions/ideas appreciated!</P> <P>Thank you! </P> <P>JLH </P> Fri, 18 Jun 2010 21:32:47 GMT https://community.splunk.com/t5/Monitoring-Splunk/OSSEC-and-SPLUNK-just-stopped/m-p/15765#M6749 jhuebner 2010-06-18T21:32:47Z https://community.splunk.com/t5/Monitoring-Splunk/OSSEC-and-SPLUNK-just-stopped/m-p/15766#M6750 <P>I got this going by running a re-install. apparently something got mad, but the reinstall fixed it.</P> <P>JLH </P> Thu, 21 Oct 2010 00:48:00 GMT https://community.splunk.com/t5/Monitoring-Splunk/OSSEC-and-SPLUNK-just-stopped/m-p/15766#M6750 jhuebner 2010-10-21T00:48:00Z