Getting Data In

What are the possible return values from the Splunk init script?

JHill
Explorer

I have a Splunk forwarder instance that appears to be returning a value of 2 during start up.

I am curious as to what the possible return values are for the init script and what they mean.

Tags (1)
1 Solution

jrodman
Splunk Employee
Splunk Employee

I assume you mean the script which ends up as /etc/init.d/splunk or similar?
This thing invokes the launcher (bin/splunk) and passes its return values along.

The values don't appear to be that useful right now.

  • 0 obviously is success.
  • 4 seems to suggest permissions problems
  • 8 refers to environment problems

The new 4.1 command line work incorporates this table:

#define EXIT_NO_ARGS 8
#define EXIT_CMD_IGNORE 9
#define EXIT_FAILURE_USAGE 10
#define EXIT_FAILURE_DEPRECATED_CMD 11
#define EXIT_FAILURE_PARSE_CMD_LINE 12
#define EXIT_FAILURE_NO_HELP_EXISTS 14
#define EXIT_FAILURE_NO_DISPLAY_FUNC 15
#define EXIT_FAILURE_NO_CMD_EXISTS 16
#define EXIT_FAILURE_NOT_IMPLEMENTED 18
#define EXIT_FAILURE_NO_OBJ_EXISTS 19
#define EXIT_FAILURE_FGETS_READ 20
#define EXIT_FAILURE_REQD_ARG_MISSING 21
#define EXIT_FAILURE_REST_CALL 22
#define EXIT_FAILURE_DISPLAY_FUNC_ERR 23
#define EXIT_FAILURE_LOGIN 24
#define EXIT_FAILURE_URI_FORMAT 25

However we incorporate third party libraries. For example in some circumstances openssl (how the splunk executable communicates with splunkd) will exit(2) on its own. Compiling a complete list right now is not likely to be useful.

Instead I would suggest:

  1. Try launching splunk yourself, ideally with the same user that the script does, or run the script yourself (sh -x -v /etc/init.d/splunk start) to see what happens.
  2. Review $SPLUNK_HOME/var/log/splunk/splunkd_stderr.log and splunkd.log

View solution in original post

jrodman
Splunk Employee
Splunk Employee

I assume you mean the script which ends up as /etc/init.d/splunk or similar?
This thing invokes the launcher (bin/splunk) and passes its return values along.

The values don't appear to be that useful right now.

  • 0 obviously is success.
  • 4 seems to suggest permissions problems
  • 8 refers to environment problems

The new 4.1 command line work incorporates this table:

#define EXIT_NO_ARGS 8
#define EXIT_CMD_IGNORE 9
#define EXIT_FAILURE_USAGE 10
#define EXIT_FAILURE_DEPRECATED_CMD 11
#define EXIT_FAILURE_PARSE_CMD_LINE 12
#define EXIT_FAILURE_NO_HELP_EXISTS 14
#define EXIT_FAILURE_NO_DISPLAY_FUNC 15
#define EXIT_FAILURE_NO_CMD_EXISTS 16
#define EXIT_FAILURE_NOT_IMPLEMENTED 18
#define EXIT_FAILURE_NO_OBJ_EXISTS 19
#define EXIT_FAILURE_FGETS_READ 20
#define EXIT_FAILURE_REQD_ARG_MISSING 21
#define EXIT_FAILURE_REST_CALL 22
#define EXIT_FAILURE_DISPLAY_FUNC_ERR 23
#define EXIT_FAILURE_LOGIN 24
#define EXIT_FAILURE_URI_FORMAT 25

However we incorporate third party libraries. For example in some circumstances openssl (how the splunk executable communicates with splunkd) will exit(2) on its own. Compiling a complete list right now is not likely to be useful.

Instead I would suggest:

  1. Try launching splunk yourself, ideally with the same user that the script does, or run the script yourself (sh -x -v /etc/init.d/splunk start) to see what happens.
  2. Review $SPLUNK_HOME/var/log/splunk/splunkd_stderr.log and splunkd.log
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...