[SOLVED] 7.3.4 to 9.0.1 upgrade - WARNING: web interface does not seem to be available- How do I resolve this issue?

[ww9rivers]

I just upgraded a dev instance from 7.3.4 to 9.0.1, and splunkd would start but the web UI stopped working.

Found these in splunkd.log:

08-30-2022 12:43:16.300 -0400 ERROR UiPythonFallback [22665 WebuiStartup] - Couldn't start appserver process on port 8065: Appserver at http://127.0.0.1:8065 never started up. Set `appServerProcessLogStderr` to "true" under [settings] in web.conf. Restart, try the operation again, and review splunkd.log for any messages that contain "UiAppServer - From appserver"
08-30-2022 12:43:16.300 -0400 ERROR UiPythonFallback [22665 WebuiStartup] - Couldn't start any appserver processes, UI will probably not function correctly!
08-30-2022 12:43:16.300 -0400 ERROR UiHttpListener [22665 WebuiStartup] - No app server is running, stop initializing http server

However, after adding the "appServerProcessLogStderr = true" setting to web.conf, I only see this one line in splunkd.log:

08-30-2022 12:48:53.628 -0400 INFO  UiAppServer [28199 appserver-stderr] - Starting stderr collecting thread

No message with "UiAppServer" after that. Any thoughts / help would be much appreciated!

[ww9rivers]

Thank you @burwell and @isoutamo for your responses. I believe you are right about the upgrade path.

We spend a bit more time on this. There is actually some logging in web_service.log file that provided hints about the problem.

The error is in the TA-SMTP-Reputation add-on in our particular case. The TA is probably not compatible with Python 3. After removing the TA from the apps folder, the server starts OK now.

[somari]

Thanks for sharing your case.

I had the same issue and your suggestion worked for me

[burwell · Accepted solution]

hi. I don't know what your issue is but I do see that for upgrade the recommended process was 7.3.x -> 8.x -> 9.x

https://docs.splunk.com/Documentation/Splunk/9.0.1/Installation/HowtoupgradeSplunk

[isoutamo]

Hi

as @burwell said you cannot update Splunk directly from 7.3 -> 9.x. The correct way is update it first to 8.0 or 8.1 and then you can update it to 9.0. I prefer to go through 8.1.

In Splunk 9 there is no more Python2 in use/available. I suppose that if/when you have done that direct update 7.3 -> 9.0 there have been missing some python update tasks (2 -> 3) and this is the reason why it said that. There are some other changes what you need to do to get all python parts to work with python3 only.

You could found more information from https://docs.splunk.com/Documentation/Splunk/latest/Python3Migration/PythonDevelopment

r. Ismo