All Apps and Add-ons

Splunk DBConnect | change ports after each daemon restart 9995 9998 | version 9.0.5

NullZero
Path Finder

I'm a Splunk PS consultant working with a client on a greenfield build, S1 SVA. They want to connect to an Oracle database and we have installed DBConnect and Java etc. After some JRE / JVM version troubleshooting and environment path challenges, it all works fine and can interrogate the Oracle instance.

Problem:

  • After each Splunk reload the DB connect fails
  • This is due to the port allocation and can be fixed by manually changing it from 9998 to 9995 for example in the GUI and saving
  • This requires manual intervention each time which is not sustainable
  • The port saves in /opt/splunk/etc/apps/splunk_app_db_connect/jars/<file>.vmopts

Has anybody else experienced this please? It's unclear if this is related to the a path variable for Java or some sort of locking and it not being able to reuse the port post daemon reload.

Labels (1)
Tags (1)
0 Karma
1 Solution

NullZero
Path Finder

We resolved the issue. In the UI all four ports were set to the same, this functioned fine and saved, but what we could see happening on Splunkd restart was that the processes were trying to obtain the same port. We set accordingly in the UI and saw this reflected in the files:

- dbxquery.vmopts set to port 9999
- servermopts set to port 9998

After this the restarts allowed dbx to run. Thanks for the suggestion.

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I haven't heard/seen such a strange thing before.

Are you using common/alternate  path to JAVA_HOME or version dependent? It shouldn't affect now but after version update it could.

Have you try to edit that *.vmopts files when splunk (and that java instances too) is down and it still change that port definition?

r. Ismo

NullZero
Path Finder

We resolved the issue. In the UI all four ports were set to the same, this functioned fine and saved, but what we could see happening on Splunkd restart was that the processes were trying to obtain the same port. We set accordingly in the UI and saw this reflected in the files:

- dbxquery.vmopts set to port 9999
- servermopts set to port 9998

After this the restarts allowed dbx to run. Thanks for the suggestion.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...