On Windows, Forwarder crash - splunk_wmi.exe

[wangzhaoyu]

Hello,

I have installed the Forwarder on windows, and Forwarder works well for a period of time.
But, forwarder crashed suddenly with error log:
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" Clean shutdown completed.

What's the reason for this crash? How to avoid it happen again? Any guidance or suggestions will be highly appreciated! Thanks!

[gcusello]

Hi @wangzhaoyu,
I had a similar problem in several projects.
One of them, it was a memory problem that I solved widening RAM.
Other times it was a problem on an old Universal Forwarder that Splunk Support solved upgrading UF.
If it continues, open a ticket to Splunk Support.

Ciao.
Giuseppe

[wangzhaoyu]

Hi @gcusello ,

thank you sooo much
we will check the memory and UF version 🙂