SIGTERM vs splunk stop

New Member

Is there a difference how to stop Splunk: using splunk stop or to send TERM signal. I'm using kuberntes and it sends TERM signal if it needs to stop a container therefore I need to understand the difference between this two options.

0 Karma

Re: SIGTERM vs splunk stop


the old "init" stop from /etc/init.d/splunk:

splunk_stop() {
  echo Stopping Splunk...
  "/opt/splunk/bin/splunk" stop
  [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/splunk

the new "systemd" stop from /etc/systemd/system/Splunkd.service:

ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd

where KillMode=mixed means:

 If set to mixed, the SIGTERM signal (see below) is sent to the main process while the subsequent SIGKILL signal (see below) is sent to all remaining processes of the unit's control group.  

where KillSignal=SIGINT:

Specifies which signal to use when stopping a service. This controls the signal that is sent as first step of shutting down a unit (see above), and is usually followed by SIGKILL (see above and below). For a list of valid signals, see signal(7). Defaults to SIGTERM.

Note that, right after sending the signal specified in this setting, systemd will always send SIGCONT, to ensure that even suspended tasks can be terminated cleanly.
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.