Deployment Architecture

At startup, Splunk is "Waiting for web server..." Will it time out and allow my server to boot?

esalesapns2
Communicator

I broke web.conf and rebooted my linux box.
Booted in AWS on splunk_marketplace_AMI_2018-09-28_14_12_30.
SSHD hasn't started yet (it's S55sshd, splunk is S50splunk in /etc/rc.d/rc3.d/)
so I can't log into the box to fix it. Now what?

Tags (3)
0 Karma
1 Solution

esalesapns2
Communicator

As of 7.3.2, Splunk uses systemd on RHEL 7 and sets the splunk startup in /etc/rc.d/rc3.d to S90splunk, avoiding this issue.

View solution in original post

0 Karma

esalesapns2
Communicator

As of 7.3.2, Splunk uses systemd on RHEL 7 and sets the splunk startup in /etc/rc.d/rc3.d to S90splunk, avoiding this issue.

0 Karma

esalesapns2
Communicator

So I never got a reply. What I figured out is that it won't timeout. It turned my instance into an unusable brick. I had to create it again from scratch to fix a simple configuration issue. After I did, I made Splunk start after sshd by renaming the Splunk startup script to S60splunk in /etc/rc.d/rc3.d on this instance and all of my other instances. That allows sshd to start so you can login to fix any Splunk configuration issues.

If you're listening, Splunk, this would be a great change to make to your installer.

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...