Why does pdf server fail with the message "ERROR pdfhandler:453 - Execution of Firefox for i386 failed"

Path Finder

I'm seeing the following errors in my python.log after trying to install the pdf server:

2010-04-08 11:43:08,580 ERROR pdfhandler:453 - Execution of Firefox for i386 failed
2010-04-08 11:43:08,580 ERROR Execution of Firefox for i386 failed
2010-04-08 11:43:08,583 ERROR pdfhandler:584 - (500) Failed to generate a report using Firefox: Failed to start: Check that all Firefox dependencies are met 

I've tried to make sure all of the dependicies are met

> rpm -aq | egrep 'Xvfb|fire|xauth'
Tags (3)

New Member

In Splunk 4.3.4 on Ubuntu server 11.4 you can fix the problem installing the libxcursor1 packet, it contains the library needed to execute the pdf generator.

0 Karma


Same btw. is happening in Splunk 4.3.2

0 Karma


We are running Splunk 4.1.2 on SLES10_64Bit and we get the same error message. When i use

DISPLAY=none $SPLUNK_HOME/etc/apps/pdfserver/bin/firefox-i386/firefox

it´s not working. But when i use the same command with the 64 Bit version:

DISPLAY=none $SPLUNK_HOME/etc/apps/pdfserver/bin/firefox-x86_64/firefox

Everthing seems fine. I guess the pdf-server apps doesn´t recognize that Splunk is on 64Bit and chooses the wrong firefox binary....

So what can we do about this?

0 Karma

Splunk Employee
Splunk Employee

That should be all you need - can you try running firefox directly and see if it reports a useful error?

Assuming $SPLUNK_HOME is set to the directory Splunk is installed in, please try running:

DISPLAY=none $SPLUNK_HOME/etc/apps/pdfserver/bin/firefox-i386/firefox

This should result in a message "Error: cannot open display: none" if all the dependencies are met, but will (hopefully) result in a more useful message in this instance.

Splunk Employee
Splunk Employee

Update: In working with Gareth this past weekend. He asked me to try to install the "bitstream-vera-fonts" package.

yum install bitstream-vera-fonts

PDF Server now works properly!!!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!