All Apps and Add-ons

Why is the Linux box "inactive" after reboot in the Splunk App for Infrastructure?

ronj_clark
Explorer

I have installed the Splunk App for Infrastructure (ver 1.1.1) and have 3 test Linux boxes working perfectly. However, a Linux box was rebooted and now the app says that the server is now "inactive". I have restarted the splunkd daemon on the system that was rebooted and it still says "inactive".

Do I have to remove the Linux box from the app, remove the UF and configs from the Linux box and then add the server back like I did initially?

0 Karma
1 Solution

ronj_clark
Explorer

The issue is that when you add a Linux asset to this app, it installs and sets up collectd. Collectd is not automatically restarted upon a reboot of the target asset. To fix this permanently, you must run the command systemctl enable collectd with root level privileges. I have tested this on a Ubuntu 16 server and a CentOS version 7 server. All is fixed now.

View solution in original post

0 Karma

ronj_clark
Explorer

The issue is that when you add a Linux asset to this app, it installs and sets up collectd. Collectd is not automatically restarted upon a reboot of the target asset. To fix this permanently, you must run the command systemctl enable collectd with root level privileges. I have tested this on a Ubuntu 16 server and a CentOS version 7 server. All is fixed now.

0 Karma

sjalexander
Path Finder

Hi Ron,

I'd suggest looking in the target index (below the app) to see whether events from that machine are being indexed. If not, check the logs on the UF to determine whether it's blocking (seems likely under the circumstances) or something else is going on.

Removing and replacing the UF and config would probably make things work again but it won't give you any insight on your problem, and it certainly won't "fix" the problem.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...