Deployment Architecture

Why am I getting an error when starting UBA?

christopherr_sp
Splunk Employee
Splunk Employee

Error when starting UBA using:

/opt/caspida/bin/Caspida start 

Starting Topologies
Exception in thread "main" org.apache.zookeeper.KeeperException$ConnectionLossException: KeeperErrorCode = ConnectionLoss for /brokers/ids
at org.apache.zookeeper.KeeperException.create(KeeperException.java:99)
at org.apache.zookeeper.KeeperException.create(KeeperException.java:51)
at org.apache.zookeeper.ZooKeeper.getChildren(ZooKeeper.java:1468)
at org.apache.zookeeper.ZooKeeper.getChildren(ZooKeeper.java:1496)
at org.apache.zookeeper.ZooKeeperMain.processZKCmd(ZooKeeperMain.java:723)
at org.apache.zookeeper.ZooKeeperMain.processCmd(ZooKeeperMain.java:591)
at org.apache.zookeeper.ZooKeeperMain.run(ZooKeeperMain.java:354)
at org.apache.zookeeper.ZooKeeperMain.main(ZooKeeperMain.java:282)

Tags (1)
0 Karma
1 Solution

christopherr_sp
Splunk Employee
Splunk Employee

Concerning the '/brokers/ids' error you should not run:

/opt/caspida/bin/Caspida start 

Instead, run:

/opt/caspida/bin/Caspida start-all 

'caspida start' is usually used against an individual service name. 

The documentation for this is included below for your future reference. 

https://docs.splunk.com/Documentation/UBA/4.1.2/Install/DeploymentArchitecture

An * indicates services that are started with the caspida start command and stopped with the caspida stop command. To start or stop all services, use caspida start-all or caspida stop-all. 

e.g. 

3 servers
postgresql 
caspida-jobagent* 
hive-metastore 
influxdb 
impala-server 
impala-catalog 
impala-state-store 
caspida-jobmanager* 

etc.

View solution in original post

0 Karma

christopherr_sp
Splunk Employee
Splunk Employee

Concerning the '/brokers/ids' error you should not run:

/opt/caspida/bin/Caspida start 

Instead, run:

/opt/caspida/bin/Caspida start-all 

'caspida start' is usually used against an individual service name. 

The documentation for this is included below for your future reference. 

https://docs.splunk.com/Documentation/UBA/4.1.2/Install/DeploymentArchitecture

An * indicates services that are started with the caspida start command and stopped with the caspida stop command. To start or stop all services, use caspida start-all or caspida stop-all. 

e.g. 

3 servers
postgresql 
caspida-jobagent* 
hive-metastore 
influxdb 
impala-server 
impala-catalog 
impala-state-store 
caspida-jobmanager* 

etc.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...