Deployment Architecture

At startup, Splunk is "Waiting for web server..." Will it time out and allow my server to boot?

esalesapns2
Path Finder

I broke web.conf and rebooted my linux box.
Booted in AWS on splunk_marketplace_AMI_2018-09-28_14_12_30.
SSHD hasn't started yet (it's S55sshd, splunk is S50splunk in /etc/rc.d/rc3.d/)
so I can't log into the box to fix it. Now what?

Tags (3)
0 Karma
1 Solution

esalesapns2
Path Finder

As of 7.3.2, Splunk uses systemd on RHEL 7 and sets the splunk startup in /etc/rc.d/rc3.d to S90splunk, avoiding this issue.

View solution in original post

0 Karma

esalesapns2
Path Finder

As of 7.3.2, Splunk uses systemd on RHEL 7 and sets the splunk startup in /etc/rc.d/rc3.d to S90splunk, avoiding this issue.

0 Karma

esalesapns2
Path Finder

So I never got a reply. What I figured out is that it won't timeout. It turned my instance into an unusable brick. I had to create it again from scratch to fix a simple configuration issue. After I did, I made Splunk start after sshd by renaming the Splunk startup script to S60splunk in /etc/rc.d/rc3.d on this instance and all of my other instances. That allows sshd to start so you can login to fix any Splunk configuration issues.

If you're listening, Splunk, this would be a great change to make to your installer.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...