Deployment Architecture

Why is my windows cluster peer node continually restarting?

jdastmalchi_spl
Splunk Employee
Splunk Employee

I've set up a new windows cluster, but one of my nodes seems to be in a continual restart. When I looked in splunkd.log, I found the following messages near each restart:

    04-03-2013 08:43:37.608 +0200 INFO  CMSlave - successfully moved bundle from 'C:\Program Files\Splunk\var\run\splunk\cluster\remote-bundle\b080fa58dab1dff841b292814b7f6c5e-1364971417' to 'C:\Program Files\Splunk\etc\slave-apps'
04-03-2013 08:43:37.608 +0200 INFO  loader - Downloaded new bundle from the cluster master. Restarting splunkd...

I've noticed that the slave-apps folder, where the configuration is supposed to end up, is empty. Has anyone seen this, and if so, how can I resolve the problem?

Tags (1)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

We've seen the splunk service account lose full permissions over the slave-apps directory on windows. Restoring those permissions stopped the restarting loop. The permissions showed "special" for the splunk service account and the Administrators group. Restoring the full permissions resolve the issue for us.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

We've seen the splunk service account lose full permissions over the slave-apps directory on windows. Restoring those permissions stopped the restarting loop. The permissions showed "special" for the splunk service account and the Administrators group. Restoring the full permissions resolve the issue for us.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...