All Apps and Add-ons

Why is the Linux box "inactive" after reboot in the Splunk App for Infrastructure?

ronj_clark
Explorer

I have installed the Splunk App for Infrastructure (ver 1.1.1) and have 3 test Linux boxes working perfectly. However, a Linux box was rebooted and now the app says that the server is now "inactive". I have restarted the splunkd daemon on the system that was rebooted and it still says "inactive".

Do I have to remove the Linux box from the app, remove the UF and configs from the Linux box and then add the server back like I did initially?

0 Karma
1 Solution

ronj_clark
Explorer

The issue is that when you add a Linux asset to this app, it installs and sets up collectd. Collectd is not automatically restarted upon a reboot of the target asset. To fix this permanently, you must run the command systemctl enable collectd with root level privileges. I have tested this on a Ubuntu 16 server and a CentOS version 7 server. All is fixed now.

View solution in original post

0 Karma

ronj_clark
Explorer

The issue is that when you add a Linux asset to this app, it installs and sets up collectd. Collectd is not automatically restarted upon a reboot of the target asset. To fix this permanently, you must run the command systemctl enable collectd with root level privileges. I have tested this on a Ubuntu 16 server and a CentOS version 7 server. All is fixed now.

View solution in original post

0 Karma

sjalexander
Path Finder

Hi Ron,

I'd suggest looking in the target index (below the app) to see whether events from that machine are being indexed. If not, check the logs on the UF to determine whether it's blocking (seems likely under the circumstances) or something else is going on.

Removing and replacing the UF and config would probably make things work again but it won't give you any insight on your problem, and it certainly won't "fix" the problem.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!