topic Re: Is there a way to automate splunk forwarder service restart on windows workstations as well as linux when they are d in Monitoring Splunk

Is there a way to automate splunk forwarder service restart on windows workstations as well as linux when they are down?

Roy_9 — Thu, 30 Mar 2023 19:59:03 GMT

Hello,

Can someone please help me with your inputs whenever the splunkd.exe and splunk-winevtlog.exe goes down? looking to set up something automatically restart these services whenever they are down.

Thanks

Re: Is there a way to automate splunk forwarder service restart on windows workstations as well as linux when they are d

gcusello — Fri, 31 Mar 2023 06:43:21 GMT

Hi @Roy_9,

are you sure that an automatic restart is the best solution?

I'd like to be informed when an UF is doen so I'd be able to analyze why it went down, not to performa an automatic restart that probably will down again because there's an issue!

Ciao.

Giuseppe

Re: Is there a way to automate splunk forwarder service restart on windows workstations as well as linux when they are d

splunkreal — Fri, 31 Mar 2023 08:21:59 GMT

Hello, you could schedule task to check status and restart with script : https://community.splunk.com/t5/Splunk-Search/Good-unix-way-check-if-splunkd-and-splunkweb-are-running/m-p/17935

Re: Is there a way to automate splunk forwarder service restart on windows workstations as well as linux when they are d

isoutamo — Fri, 31 Mar 2023 09:45:20 GMT

In Windows there is standard options on service configuration where you can set what happening if service crashed or goes down. Just select restart and also how many times is can try that to avoid @gcusello notice that it's good to get reason for that instead of just restart it again and again.

On linux you should use systemd to start service and let it manage that as in windows. Here is one link where it has described. https://ma.ttias.be/auto-restart-crashed-service-systemd/

Anyhow if UF goes down regularly you must solve the reason for that.

r. Ismo