Splunk Search

is_pid_valid

thiru25
Explorer

I am seeing this error, causing splunk to not start, how can I resolve it?

Operation "is_pid_valid" failed in /opt/splunk/p4/splunk/branches/5.0.2/src/libzero/conf-mutator-locking.c:261, conf_mutator_lock(); Operation not permitted
Conf mutator lockfile has PID 26728, but my PID is 24004; error condition likely.

Tags (2)

andykuhn
Path Finder

In my circumstance, within the /var/run/splunk dir, I had NO .pid file. Otherwise my error and circumstance were identical.

To fix the issue, previous 'session' files were copied to another folder I called 'old_sessions'. Upon restart, with the session data cleared, the pid file regenerated properly and everything looks fine.

0 Karma

gudavasr
Path Finder

In $SPLUNK_HOME/var/run/splunk ..there are files with .pid. One of it is conf-mutator-.pid.
Somehow this file is not deleted when splunk is stopped. Hence this error. To resolve:
1) stop splunk to stop all the process.
2) rename conf-mutator-*.pid
3) start splunk.

Thnak yosu

gudavasr
Path Finder

Hi,

Does any one know solution for this issue? I have the same issue after patching this server.
Can someone please help?

Thank You

0 Karma

droth333
Explorer

Can we get a splunker to comment on this? "Error condition likely",
as in, can you name a few?
This has happened to me too, it can't be that uncommon,
though this issue has low readership.
thanks!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...