Deployment Architecture

Why am I getting an error when starting UBA?

christopherr_sp
Splunk Employee
Splunk Employee

Error when starting UBA using:

/opt/caspida/bin/Caspida start 

Starting Topologies
Exception in thread "main" org.apache.zookeeper.KeeperException$ConnectionLossException: KeeperErrorCode = ConnectionLoss for /brokers/ids
at org.apache.zookeeper.KeeperException.create(KeeperException.java:99)
at org.apache.zookeeper.KeeperException.create(KeeperException.java:51)
at org.apache.zookeeper.ZooKeeper.getChildren(ZooKeeper.java:1468)
at org.apache.zookeeper.ZooKeeper.getChildren(ZooKeeper.java:1496)
at org.apache.zookeeper.ZooKeeperMain.processZKCmd(ZooKeeperMain.java:723)
at org.apache.zookeeper.ZooKeeperMain.processCmd(ZooKeeperMain.java:591)
at org.apache.zookeeper.ZooKeeperMain.run(ZooKeeperMain.java:354)
at org.apache.zookeeper.ZooKeeperMain.main(ZooKeeperMain.java:282)

Tags (1)
0 Karma
1 Solution

christopherr_sp
Splunk Employee
Splunk Employee

Concerning the '/brokers/ids' error you should not run:

/opt/caspida/bin/Caspida start 

Instead, run:

/opt/caspida/bin/Caspida start-all 

'caspida start' is usually used against an individual service name. 

The documentation for this is included below for your future reference. 

https://docs.splunk.com/Documentation/UBA/4.1.2/Install/DeploymentArchitecture

An * indicates services that are started with the caspida start command and stopped with the caspida stop command. To start or stop all services, use caspida start-all or caspida stop-all. 

e.g. 

3 servers
postgresql 
caspida-jobagent* 
hive-metastore 
influxdb 
impala-server 
impala-catalog 
impala-state-store 
caspida-jobmanager* 

etc.

View solution in original post

0 Karma

christopherr_sp
Splunk Employee
Splunk Employee

Concerning the '/brokers/ids' error you should not run:

/opt/caspida/bin/Caspida start 

Instead, run:

/opt/caspida/bin/Caspida start-all 

'caspida start' is usually used against an individual service name. 

The documentation for this is included below for your future reference. 

https://docs.splunk.com/Documentation/UBA/4.1.2/Install/DeploymentArchitecture

An * indicates services that are started with the caspida start command and stopped with the caspida stop command. To start or stop all services, use caspida start-all or caspida stop-all. 

e.g. 

3 servers
postgresql 
caspida-jobagent* 
hive-metastore 
influxdb 
impala-server 
impala-catalog 
impala-state-store 
caspida-jobmanager* 

etc.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...