Deployment Architecture

Why is a Splunk forwarder creating a zombie process when starting via systemd?

rayrayrayray
New Member

I have installed version 7.2.4 of the Splunk Forwarder from the deb package on a x64 Ubuntu 18.04.1 LTS system. After the install, I used this command to generate the systemd unit file.

/opt/splunkforwarder/bin/splunk enable boot-start -user splunk --accept-license --no-prompt --answer-yes

The service starts and runs without any issue, but I'm always left with a zombie process on my system. If I stop the SplunkForwarder service, it goes away, and comes back when it's started again.

*USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
splunk 29920 0.0 0.0 0 0 ? Z 10:55 0:00 [systemctl] *

Does anyone know a way to get rid of this?

0 Karma

rayrayrayray
New Member

I've upgraded to 7.2.6 and it looks like the issue is resolved.

0 Karma

sreechallagundl
New Member

thanks ray... but why its coming, i didn't see any documentation from splunk GCS team, seems they even didn't bother about it...

0 Karma

ptcrusher
Explorer

Were you able to sort it out? I'm facing the exact same issue

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...