topic Re: Splunk universal forwarder crashes frequently- What is causing these errors? in Splunk Search

Splunk universal forwarder crashes frequently- What is causing these errors?

lawrence_magpoc — Wed, 09 Nov 2022 17:40:40 GMT

After upgrading our universal forwarder to 9.0.1, it started crashing almost everyday. I looked at the splunkd.log and saw these errors:

11-09-2022 10:48:18.422 -0500 ERROR TcpOutputQ [25141 TcpOutEloop] - Unexpected event id=5669
11-09-2022 10:48:18.422 -0500 ERROR TcpOutputQ [25141 TcpOutEloop] - Unexpected event id=5669
11-09-2022 10:48:18.423 -0500 ERROR TcpOutputQ [25141 TcpOutEloop] - Unexpected event id=5670
11-09-2022 10:48:18.423 -0500 ERROR TcpOutputQ [25141 TcpOutEloop] - Unexpected event id=5670
11-09-2022 10:48:18.429 -0500 ERROR TcpOutputQ [25141 TcpOutEloop] - Unexpected event id=5677
11-09-2022 10:48:18.429 -0500 ERROR TcpOutputQ [25141 TcpOutEloop] - Unexpected event id=5677

How do I know what's causing these errors?

Re: Splunk universal forwarder crashes frequently- What is causing these errors?

richgalloway — Mon, 14 Nov 2022 21:35:17 GMT

Consider contacting Splunk Support for help with that.

Re: Splunk universal forwarder crashes frequently- What is causing these errors?

lawrence_magpoc — Fri, 28 Apr 2023 17:25:02 GMT

I fixed the problem by adding this to my config:

autoBatch=false

I got the solution from this thread:
https://community.splunk.com/t5/Getting-Data-In/Why-this-error-after-upgrade-to-9-0-quot-ERROR-TcpOutputQ-lt/m-p/605753/highlight/true

Re: Splunk universal forwarder crashes frequently- What is causing these errors?

anandhalagaras1 — Thu, 08 Feb 2024 12:09:56 GMT

@lawrence_magpoc ,

I am running with Splunk Universal Forwarder 9.0.2 in one of my Linux client machine and recently for the past couple of days i am getting this events in the internal logs and it seems like its getting crashed and once again the service is getting started automatically.

[build 17e00c557dc1] 2024-02-08 05:26:15 Received fatal signal 6 (Aborted) on PID 1908113. Cause: Signal sent by PID 1908113 running under UID 9991. Crashing thread: TcpOutEloop Registers: RIP: [0x00007F65EB39AACF] gsignal + 271 (libc.so.6 + 0x4EACF)

ERROR TcpOutputQ [1908232 TcpOutEloop] - Unexpected event id=30

ERROR TcpOutputQ [1908232 TcpOutEloop] - Unexpected event id=29

So how to fix this issue and also in which config file we need to add in the client machine where UF is running.

autoBatch=false