Deployment Architecture

splunk db connector RPC server

Federica_92
Communicator

Hi everyone, I have installed splunk db connector 2, using the last splunk version.
I have follow the installation step, so I have installed mysql, jre and the db driver.

Still I have a problem: RPC service down, I have active the debug mode to check where could be the problem, and these are the log:

  04/08/2015 03:02:47 [CRITICAL] [rpcstart.py] RPC server has been terminated abnormally with error [[Errno 2] No such file or directory].
  04/08/2015 03:02:46 [CRITICAL] [rpcstart.py] attempting to disable RPC server "rpcstart://default"
  04/08/2015 03:02:46 [CRITICAL] [rpcstart.py] rpcstart failed with Exception: "[Errno 2] No such file or directory"
  04/08/2015 03:02:46 [DEBUG] [rpcstart.py] UseSSL: False
  04/08/2015 03:02:46 [DEBUG] [rpcstart.py] start running
  04/08/2015 03:02:31 [DEBUG] [rpcstart.py] jcommand = [u'/opt/jre1.8.0_40/bin/java', u'-Xmx1024m', u'-XX:+UseConcMarkSweepGC', '-classpath', '/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/commons-logging-1.1.2.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/mysql-connector-java-5.1.35-bin.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-http-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/slf4j-api-1.7.7.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jackson-all-1.9.11.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/servlet-api-3.1.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/slf4j-log4j12-1.7.7.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/avro-compiler-1.7.6.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/avro-1.7.6.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-server-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-servlet-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-security-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/antlr4-annotations-4.4.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-io-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/dbx2.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/avro-ipc-1.7.6.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/log4j-1.2.17.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/antlr4-runtime-4.4.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-util-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/javax-websocket-server-impl-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/slf4j-ext-1.7.7.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-client-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/javax.websocket-api-1.0.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-servlet-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/jcs-2.0.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-api-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-common-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-server-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/commons-io-2.4.jar', '-DSPLUNK_HOME=/opt/splunk', 'com.splunk.dbx2.rpc.RPCServer', u'127.0.0.1:9998']

May someone help me? Thank you!

Tags (3)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

I had a very similar problem which turned out to be something incorrect in my path specification for Java. My test machine for DBX2 is windows, and though I forgot what the path had been (something VERY much like the correct path below, but not identical), but changing that path to C:\Program Files\Java\jre8\jre fixed the issue.

In your case, is /opt/jre1.8.0_40/bin/java correct insofar as it goes? You may need to specify a subdirectory under that. Worth a try, anyway.

View solution in original post

chojrak11
Engager

In case of CentOS 6.6 with java-1.8.0-openjdk package, correct directory to Java that worked with Splunk was
/usr/lib/jvm/jre-1.8.0.


More info: I first used /usr/lib/jvm/jre (DO NOT use it), but then the following started to appear in dbx2.log:

[CRITICAL] [rpcstart.py] RPC server has been terminated abnormally with error [Exception in thread "main" java.lang.UnsupportedClassVersionError: com/splunk/dbx2/rpc/RPCServer : unsupported major.minor version 52.0].

It turned out that default Java version for CentOS is Java 7, and the DBConnect 2 was compiled for Java 8.

Richfez
SplunkTrust
SplunkTrust

I had a very similar problem which turned out to be something incorrect in my path specification for Java. My test machine for DBX2 is windows, and though I forgot what the path had been (something VERY much like the correct path below, but not identical), but changing that path to C:\Program Files\Java\jre8\jre fixed the issue.

In your case, is /opt/jre1.8.0_40/bin/java correct insofar as it goes? You may need to specify a subdirectory under that. Worth a try, anyway.

imanpoeiri
Communicator

I added \bin in my case

0 Karma

ViniciusANT
Explorer

Where should I change the jre path ??

0 Karma

Federica_92
Communicator
0 Karma

Federica_92
Communicator

Thank you so much, I have solved the problem installing jre under usr instead of opt : )

0 Karma

jwelsh_splunk
Splunk Employee
Splunk Employee

In my case, for Mac OSX, I needed to use: /Library/Java/JavaVirtualMachines/jdk1.8.0_45.jdk/Contents/Home/jre for Java JDK 1.8.0.45.

Edmondi
Explorer

Thanks for the tip @jwelsh_splunk.

0 Karma

emcathalo
New Member

In my case, Windows 2008 R2, the correct path is: C:/Program Files/Java/jdk1.8.0_45/jre

0 Karma
Get Updates on the Splunk Community!

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...