Deployment Architecture

splunk db connector RPC server

Federica_92
Communicator

Hi everyone, I have installed splunk db connector 2, using the last splunk version.
I have follow the installation step, so I have installed mysql, jre and the db driver.

Still I have a problem: RPC service down, I have active the debug mode to check where could be the problem, and these are the log:

  04/08/2015 03:02:47 [CRITICAL] [rpcstart.py] RPC server has been terminated abnormally with error [[Errno 2] No such file or directory].
  04/08/2015 03:02:46 [CRITICAL] [rpcstart.py] attempting to disable RPC server "rpcstart://default"
  04/08/2015 03:02:46 [CRITICAL] [rpcstart.py] rpcstart failed with Exception: "[Errno 2] No such file or directory"
  04/08/2015 03:02:46 [DEBUG] [rpcstart.py] UseSSL: False
  04/08/2015 03:02:46 [DEBUG] [rpcstart.py] start running
  04/08/2015 03:02:31 [DEBUG] [rpcstart.py] jcommand = [u'/opt/jre1.8.0_40/bin/java', u'-Xmx1024m', u'-XX:+UseConcMarkSweepGC', '-classpath', '/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/commons-logging-1.1.2.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/mysql-connector-java-5.1.35-bin.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-http-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/slf4j-api-1.7.7.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jackson-all-1.9.11.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/servlet-api-3.1.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/slf4j-log4j12-1.7.7.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/avro-compiler-1.7.6.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/avro-1.7.6.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-server-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-servlet-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-security-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/antlr4-annotations-4.4.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-io-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/dbx2.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/avro-ipc-1.7.6.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/log4j-1.2.17.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/antlr4-runtime-4.4.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-util-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/javax-websocket-server-impl-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/slf4j-ext-1.7.7.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-client-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/javax.websocket-api-1.0.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-servlet-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/jcs-2.0.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-api-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-common-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-server-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/commons-io-2.4.jar', '-DSPLUNK_HOME=/opt/splunk', 'com.splunk.dbx2.rpc.RPCServer', u'127.0.0.1:9998']

May someone help me? Thank you!

Tags (3)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

I had a very similar problem which turned out to be something incorrect in my path specification for Java. My test machine for DBX2 is windows, and though I forgot what the path had been (something VERY much like the correct path below, but not identical), but changing that path to C:\Program Files\Java\jre8\jre fixed the issue.

In your case, is /opt/jre1.8.0_40/bin/java correct insofar as it goes? You may need to specify a subdirectory under that. Worth a try, anyway.

View solution in original post

chojrak11
Engager

In case of CentOS 6.6 with java-1.8.0-openjdk package, correct directory to Java that worked with Splunk was
/usr/lib/jvm/jre-1.8.0.


More info: I first used /usr/lib/jvm/jre (DO NOT use it), but then the following started to appear in dbx2.log:

[CRITICAL] [rpcstart.py] RPC server has been terminated abnormally with error [Exception in thread "main" java.lang.UnsupportedClassVersionError: com/splunk/dbx2/rpc/RPCServer : unsupported major.minor version 52.0].

It turned out that default Java version for CentOS is Java 7, and the DBConnect 2 was compiled for Java 8.

Richfez
SplunkTrust
SplunkTrust

I had a very similar problem which turned out to be something incorrect in my path specification for Java. My test machine for DBX2 is windows, and though I forgot what the path had been (something VERY much like the correct path below, but not identical), but changing that path to C:\Program Files\Java\jre8\jre fixed the issue.

In your case, is /opt/jre1.8.0_40/bin/java correct insofar as it goes? You may need to specify a subdirectory under that. Worth a try, anyway.

imanpoeiri
Communicator

I added \bin in my case

0 Karma

ViniciusANT
Explorer

Where should I change the jre path ??

0 Karma

Federica_92
Communicator
0 Karma

Federica_92
Communicator

Thank you so much, I have solved the problem installing jre under usr instead of opt : )

0 Karma

jwelsh_splunk
Splunk Employee
Splunk Employee

In my case, for Mac OSX, I needed to use: /Library/Java/JavaVirtualMachines/jdk1.8.0_45.jdk/Contents/Home/jre for Java JDK 1.8.0.45.

Edmondi
Explorer

Thanks for the tip @jwelsh_splunk.

0 Karma

emcathalo
New Member

In my case, Windows 2008 R2, the correct path is: C:/Program Files/Java/jdk1.8.0_45/jre

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...