Installation

Why did forwarder shutdown after start?

pbnl
Path Finder

hi again 🙂

after upgrading our 26 linux universal forwarders from 7.x to 8.2.5, one of them will not run anymore.
it immediately shuts down itself after start.
splunkd.log shows nothing special for me. here some lines:

03-30-2022 13:03:03.587 +0200 INFO WatchedFile [110115 tailreader0] - File too small to check seek
crc, probably truncated. Will re-read entire file='/opt/splunkforwarder/var/log/splunk/splunk_instrumentation_cloud.log'.
03-30-2022 13:03:04.440 +0200 INFO AutoLoadBalancedConnectionStrategy [110109 TcpOutEloop] - Connected to idx=172.17.1.91:9997, pset=0, reuse=0. using ACK.
03-30-2022 13:03:05.997 +0200 INFO loader [110063 HTTPDispatch] - Shutdown HTTPDispatchThread
03-30-2022 13:03:06.031 +0200 INFO ShutdownHandler [110076 Shutdown] - Shutting down splunkd
03-30-2022 13:03:06.031 +0200 INFO ShutdownHandler [110076 Shutdown] - shutting down level "ShutdownLevel_Begin"
03-30-2022 13:03:06.031 +0200 INFO ShutdownHandler [110076 Shutdown] - shutting down level "ShutdownLevel_NoahHealthReport"

any ideas?
thanks...

Labels (3)
0 Karma
1 Solution

pbnl
Path Finder

hi @gcusello ,

thanks for the fast answer, but that wasn't the problem.

i used this app adapted to my needs to upgrade my forwarders. for some reason, on the not running forwarder, the script was always started, everytime splunkd was started. it stopped splunkd and exited.
removed the app, and it's running again.

strange, but hey, it's a computer 😉

View solution in original post

0 Karma

gcusello
Legend

Hi @pbnl,

did you checked the available memory?

did you checked if the old installation is always active?

Ciao.

Giuseppe

0 Karma

pbnl
Path Finder

hi @gcusello ,

thanks for the fast answer, but that wasn't the problem.

i used this app adapted to my needs to upgrade my forwarders. for some reason, on the not running forwarder, the script was always started, everytime splunkd was started. it stopped splunkd and exited.
removed the app, and it's running again.

strange, but hey, it's a computer 😉

0 Karma

gcusello
Legend

Hi @pbnl,

good for you if you solved your problem, please accept the answer for the other people of Community, otherwise tell me how can I help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

pbnl
Path Finder

ok. i will do.

and indeed, you can help me with another issue. but in a new thread 😉

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...