Getting Data In

stopping all listening ports?

piebob
Splunk Employee
Splunk Employee

reposting for a user over on the forums:

I bounced my indexer and now my forwarders are unable to connect. I just upgraded this indexer to 4.1.2 (although it's been working for hours since the upgrade).

The error in the splunkd.log is: TcpInputProc - Stopping all listening ports. Queues blocked for more than 300 seconds

What does this mean? I can't seem to find any relevant info. This is a 64b OpenSuse10.3 box.

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

For whatever reason, indexing is not going on, so the indexer has stopped accepting data on input ports. It might be because you're out of space, or your indexes are otherwise locked out (possibly because permissions aren't enabled). It's seems likely there will be other errors in splunkd.log, or clues in metrics.log

View solution in original post

Chris_R_
Splunk Employee
Splunk Employee

I was actually working with this user in the official support channels, I think the problem was his inputs.conf had the queues specified with
[inputstanza]
queue = parsingQueue

Looking at his metric queue diagnostics he was getting over 1000 events in his parsing queue even at fairly slow times. We removed the queue setting entirely and he's no longer getting queue blocked message, queue's dont have to be explicitly specified in 4.x. as splunk should default to parsing queue for all stanzas.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

For whatever reason, indexing is not going on, so the indexer has stopped accepting data on input ports. It might be because you're out of space, or your indexes are otherwise locked out (possibly because permissions aren't enabled). It's seems likely there will be other errors in splunkd.log, or clues in metrics.log

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...