Deployment Architecture

Why is a Splunk forwarder creating a zombie process when starting via systemd?

rayrayrayray
New Member

I have installed version 7.2.4 of the Splunk Forwarder from the deb package on a x64 Ubuntu 18.04.1 LTS system. After the install, I used this command to generate the systemd unit file.

/opt/splunkforwarder/bin/splunk enable boot-start -user splunk --accept-license --no-prompt --answer-yes

The service starts and runs without any issue, but I'm always left with a zombie process on my system. If I stop the SplunkForwarder service, it goes away, and comes back when it's started again.

*USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
splunk 29920 0.0 0.0 0 0 ? Z 10:55 0:00 [systemctl] *

Does anyone know a way to get rid of this?

0 Karma

rayrayrayray
New Member

I've upgraded to 7.2.6 and it looks like the issue is resolved.

0 Karma

sreechallagundl
New Member

thanks ray... but why its coming, i didn't see any documentation from splunk GCS team, seems they even didn't bother about it...

0 Karma

ptcrusher
Explorer

Were you able to sort it out? I'm facing the exact same issue

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...