All Apps and Add-ons

VMWare app scheduled searches are crashing

dchodur
Path Finder

Has anyone seen where the VMWare app crashes at least once a min with having SA-VMW-HierarchyInventory enabled in the app. Here is the log off the dump. Did open a support case as well but thought I would ask here as well.


[build 123586] 2012-07-12 17:20:05
Access violation, cannot read at address [0x0000000000000040]
Exception address: [0x00000001403A5FB1]
Crashing thread: dispatch
MxCsr: [0x0000000000001FA0]
SegDs: [0x000000000000002B]
SegEs: [0x000000000000002B]
SegFs: [0x0000000000000053]
SegGs: [0x000000000000002B]
SegSs: [0x000000000000002B]
SegCs: [0x0000000000000033]
EFlags: [0x0000000000010206]
Rsp: [0x000000000230D480]
Rip: [0x00000001403A5FB1] ?
Dr0: [0x0000000000000000]
Dr1: [0x0000000000000000]
Dr2: [0x0000000000000000]
Dr3: [0x0000000000000000]
Dr6: [0x0000000000000000]
Dr7: [0x0000000000000000]
Rax: [0x000000000265A410]
Rcx: [0x0000000002948C10]
Rdx: [0x0000000000000000]
Rbx: [0x00000000029DFAB0]
Rbp: [0x0000000000000000]
Rsi: [0x0000000000000008]
Rdi: [0x000000000265A310]
R8: [0x0000000000000000]
R9: [0x0000000000000000]
R10: [0x0000000000000000]
R11: [0x0000000000000286]
R12: [0x000000000230D5B0]
R13: [0x000000000230DA38]
R14: [0x00000000029CBFD0]
R15: [0x000000000230D540]
DebugControl: [0x00000000710194D9]
LastBranchToRip: [0x0000000000000000]
LastBranchFromRip: [0x0000000000000000]
LastExceptionToRip: [0x0000000000000000]
LastExceptionFromRip: [0x0000000000000000]

OS: Windows
Arch: x86-64

Backtrace:
[0x00000001403A5FB1] ?
[0x00000001403B5FD2] ?
[0x0000000140440A98] ?
[0x0000000140441227] ?
[0x00000001403EFFBE] ?
[0x0000000140B3551A] ?
[0x0000000140B3F668] ?
[0x0000000140B44023] ?
[0x00000001408F1A82] ?
[0x0000000140004537] ?
[0x00000000736637D7] endthreadex + 71/272
[0x0000000073663894] endthreadex + 260/272
[0x0000000076B1652D] BaseThreadInitThunk + 13/96
[0x0000000076EFC521] RtlUserThreadStart + 33/1024
Crash dump written to: C:\Program Files\Splunk\var\log\splunk\C__Program Files_Splunk_bin_splunkd_exe_crash-2012-07-12-17-20-05.dmp

CHODURDJTEST /6.1 Service Pack 1
Threads running: 2
argv: [splunkd search --id=scheduler_admin_U0EtVk1XLUhpZXJhcmNoeUludmVudG9yeQ_TimeHierarchyClusterUpdate_at_1342131600_f123db188cccd28f --maxbuckets=0 --ttl=1200 --maxout=500000 --maxtime=8640000 --lookups=1 --reduce_freq=10 --user=admin --pro --roles=admin:power:user]
terminating...

1 Solution

hexx
Splunk Employee
Splunk Employee

It seems that you are hitting core Splunk bug SPL-53256, which is specific to Windows and causes searches to crash when they load empty file-based lookup tables. The searches of the VMWare app use and maintaining a lot of lookups which makes them prime candidates to trigger this bug.

This bug has been fixed in Splunk 4.3.4.

View solution in original post

hexx
Splunk Employee
Splunk Employee

It seems that you are hitting core Splunk bug SPL-53256, which is specific to Windows and causes searches to crash when they load empty file-based lookup tables. The searches of the VMWare app use and maintaining a lot of lookups which makes them prime candidates to trigger this bug.

This bug has been fixed in Splunk 4.3.4.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...