Why is the Linux box "inactive" after reboot in the Splunk App for Infrastructure?

[ronj_clark]

I have installed the Splunk App for Infrastructure (ver 1.1.1) and have 3 test Linux boxes working perfectly. However, a Linux box was rebooted and now the app says that the server is now "inactive". I have restarted the splunkd daemon on the system that was rebooted and it still says "inactive".

Do I have to remove the Linux box from the app, remove the UF and configs from the Linux box and then add the server back like I did initially?

[ronj_clark · Accepted solution]

The issue is that when you add a Linux asset to this app, it installs and sets up collectd. Collectd is not automatically restarted upon a reboot of the target asset. To fix this permanently, you must run the command systemctl enable collectd with root level privileges. I have tested this on a Ubuntu 16 server and a CentOS version 7 server. All is fixed now.

[sjalexander]

Hi Ron,

I'd suggest looking in the target index (below the app) to see whether events from that machine are being indexed. If not, check the logs on the UF to determine whether it's blocking (seems likely under the circumstances) or something else is going on.

Removing and replacing the UF and config would probably make things work again but it won't give you any insight on your problem, and it certainly won't "fix" the problem.