Deployment Architecture

Splunk crashes after error popped up: ENGINE: Bus STOPPED

justynap_ldz
Path Finder

Hello Splunkers,

Splunk crashes on our Linux core servers (Master, Search Heads and Heavy Forwarders, indexers are not affected) with "ENGINE: Bus STOPPED" errors. 
When I check splunkd status on host, it turns out that:
se1234@z1il1234:~> /opt/splunk/bin/splunk status
splunkd 130820 was not running.
Stopping splunk helpers...Done.
Stopped helpers.
Removing stale pid file... done.
It is an intermittent issue. Today in the morning we had this issue on SH1, yesterday on another SH2 and a week before on SH4. We have checked Resource usage and there is nothing shown in DMC that may cause splunkd to crash (e.g. high CPU usage)

Any idea what is worth checking or how to troubleshoot?
Greetings,
Dzasta

0 Karma

justynap_ldz
Path Finder

Thank you @richgalloway, I have just contacted Splunk Support 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You should contact Splunk Support for assistance.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...