task server stopped working

[sarit_s]

Hello

Using Splunk db connect 3.13.0 which worked fine until I've restarted the server

since then the task server is not starting and im getting this error :

message from "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxquery.sh" com.splunk.modularinput.Event.writeTo(Event.java:65)\\com.splunk.modularinput.EventWriter.writeEvent(EventWriter.java:137)\\com.splunk.dbx.command.DbxQueryServerStart.streamEvents(DbxQueryServerStart.java:51)\\com.splunk.modularinput.Script.run(Script.java:66)\\com.splunk.modularinput.Script.run(Script.java:44)\\com.splunk.dbx.command.DbxQueryServerStart.main(DbxQueryServerStart.java:95)\\

ERROR ExecProcessor [15275 ExecProcessorSchedulerThread] - message from "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxquery.sh" action=dbxquery_server_start_failed error=java.security.GeneralSecurityException: Only salted password is supported

[deepakc]

It could a be several things post restart.

Get some more info from the _internal logs - this may help further investigate and identify the issue

index=_internal sourcetype=splunkd splunk_app_db_connect

index="_internal" sourcetype=splunkd "db_connect" log_level=ERROR

Check the KVstore status

| rest splunk_server=local count=1 /services/server/info

| table kvStoreStatus

OR

$SPLUNK_HOME/bin/splunk show kvstore-status --verbose

Check DB APP permissions

chown -R splunk:splunk $SPLUNK_HOME/etc/apps/splunk_app_db_connect

Sometimes it won’t start due to default certs, as they may have expired,  If using the Splunk default certificates, move or rename the file .old etc the $SPLUNK_HOME/etc/auth/server.pem file and restart Splunk to regenerate the certificate.

Check the JAVA server

java –version

Make sure it's compatible

https://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Prerequisites

See if there some additional help via troubleshooting page

https://docs.splunk.com/Documentation/DBX/3.16.0/DeployDBX/TroubleshootingTool

If that all fails to help resolve the issue, log a  support case.