https://community.splunk.com/t5/Monitoring-Splunk/Why-is-my-splunk-daemon-crashing/m-p/87897#M7399 <P>It seems like every other day I attempt to use Splunk and I get the following:</P> <P>"503 Service Unavailable</P> <P>Return to Splunk home page</P> <P>The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running."</P> <P>I then restart splunkd and I can get back in. I'm pretty new to splunk, so I'm unsure how to troubleshoot this. Is there a log that will help me diagnose this issue? I noticed in the license_audit.log it says the following:</P> <P>"10-11-2012 00:00:01.015 INFO LicenseManager-Audit - Audit:[quotaExceededCount=0, lastExceedDate=1331794800, peak=213689346, rolloverCount=3, totalCumulativeBytesAtRollover=213689346, todaysBytesIndexed=213689346, licenseSize=524288000][C2e5bdtQOCkMHQNZsE3EhmfY7l5E/F7K7liuBjCy8xR708UOgo1jK3zZxhQsgKDzLV/+eyDh1sfGuWRIhjUqrKouiRVK6YtLX1PosMy4W9L6vankNm60b4pV4YB3hcZ8wD2WPmpm17hxCWqfCKB+rKTSq1XjuFBa7XNpdUHeE1eeEikdIMOeh8obqf1Im//Jajxi6zZ+4OF44Vj29h6PwrMULwVMbE2X3Hgh+w/+nPjxbp1mAPlOsrNIvKG7iCJV30zyiPA4VT2HarE8MdDG546WWkrVGx36hgsPy3WapBp8elLdwiqGFVMxGFTngQOgUBWB7VYHWtxphN/nUE2Lzg==]"</P> <P>Could this be a simple case of just processing too many logs for my given license?</P> <P>Running on Ubuntu 10.04 with Splunk 4.3 build 115073, using the free license.</P> <P>Any help would be greatly appreciated.</P> <P>AG</P> <P><A href="mailto:aarong@smartshoot.com">aarong@smartshoot.com</A></P> Thu, 11 Oct 2012 23:05:05 GMT aarongolub 2012-10-11T23:05:05Z https://community.splunk.com/t5/Monitoring-Splunk/Why-is-my-splunk-daemon-crashing/m-p/87897#M7399 <P>It seems like every other day I attempt to use Splunk and I get the following:</P> <P>"503 Service Unavailable</P> <P>Return to Splunk home page</P> <P>The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running."</P> <P>I then restart splunkd and I can get back in. I'm pretty new to splunk, so I'm unsure how to troubleshoot this. Is there a log that will help me diagnose this issue? I noticed in the license_audit.log it says the following:</P> <P>"10-11-2012 00:00:01.015 INFO LicenseManager-Audit - Audit:[quotaExceededCount=0, lastExceedDate=1331794800, peak=213689346, rolloverCount=3, totalCumulativeBytesAtRollover=213689346, todaysBytesIndexed=213689346, licenseSize=524288000][C2e5bdtQOCkMHQNZsE3EhmfY7l5E/F7K7liuBjCy8xR708UOgo1jK3zZxhQsgKDzLV/+eyDh1sfGuWRIhjUqrKouiRVK6YtLX1PosMy4W9L6vankNm60b4pV4YB3hcZ8wD2WPmpm17hxCWqfCKB+rKTSq1XjuFBa7XNpdUHeE1eeEikdIMOeh8obqf1Im//Jajxi6zZ+4OF44Vj29h6PwrMULwVMbE2X3Hgh+w/+nPjxbp1mAPlOsrNIvKG7iCJV30zyiPA4VT2HarE8MdDG546WWkrVGx36hgsPy3WapBp8elLdwiqGFVMxGFTngQOgUBWB7VYHWtxphN/nUE2Lzg==]"</P> <P>Could this be a simple case of just processing too many logs for my given license?</P> <P>Running on Ubuntu 10.04 with Splunk 4.3 build 115073, using the free license.</P> <P>Any help would be greatly appreciated.</P> <P>AG</P> <P><A href="mailto:aarong@smartshoot.com">aarong@smartshoot.com</A></P> Thu, 11 Oct 2012 23:05:05 GMT https://community.splunk.com/t5/Monitoring-Splunk/Why-is-my-splunk-daemon-crashing/m-p/87897#M7399 aarongolub 2012-10-11T23:05:05Z https://community.splunk.com/t5/Monitoring-Splunk/Why-is-my-splunk-daemon-crashing/m-p/87898#M7400 <P>Hi aarongolub</P> <P>this message is not the cause for your crash and you are not processing too many logs, yet <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>Have you installed the <A href="http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk">S.o.S.</A> app on your Splunk? This app will help you pretty easy to figure out what is causing the crashes or you search <CODE>index=_internal</CODE> on your own.</P> <P>cheers,<BR /> MuS</P> Fri, 12 Oct 2012 07:27:09 GMT https://community.splunk.com/t5/Monitoring-Splunk/Why-is-my-splunk-daemon-crashing/m-p/87898#M7400 MuS 2012-10-12T07:27:09Z