All Apps and Add-ons

Why is the Linux box "inactive" after reboot in the Splunk App for Infrastructure?

ronj_clark
Explorer

I have installed the Splunk App for Infrastructure (ver 1.1.1) and have 3 test Linux boxes working perfectly. However, a Linux box was rebooted and now the app says that the server is now "inactive". I have restarted the splunkd daemon on the system that was rebooted and it still says "inactive".

Do I have to remove the Linux box from the app, remove the UF and configs from the Linux box and then add the server back like I did initially?

0 Karma
1 Solution

ronj_clark
Explorer

The issue is that when you add a Linux asset to this app, it installs and sets up collectd. Collectd is not automatically restarted upon a reboot of the target asset. To fix this permanently, you must run the command systemctl enable collectd with root level privileges. I have tested this on a Ubuntu 16 server and a CentOS version 7 server. All is fixed now.

View solution in original post

0 Karma

ronj_clark
Explorer

The issue is that when you add a Linux asset to this app, it installs and sets up collectd. Collectd is not automatically restarted upon a reboot of the target asset. To fix this permanently, you must run the command systemctl enable collectd with root level privileges. I have tested this on a Ubuntu 16 server and a CentOS version 7 server. All is fixed now.

0 Karma

sjalexander
Path Finder

Hi Ron,

I'd suggest looking in the target index (below the app) to see whether events from that machine are being indexed. If not, check the logs on the UF to determine whether it's blocking (seems likely under the circumstances) or something else is going on.

Removing and replacing the UF and config would probably make things work again but it won't give you any insight on your problem, and it certainly won't "fix" the problem.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...