Installation

couldn't send SIGTERM to pid 5632: Operation not permitted

adityapavan18
Contributor

I am getting following error while i am trying to start the splunk forwarder process.
Can anyone please help me??

Tags (1)
1 Solution

adityapavan18
Contributor

Thanks seems to have resolved it after i deleted the splunk.pid file from var/run folder inside splunk.

View solution in original post

koshyk
Super Champion

Agree, the answer is removing .pid file, but for easy copy and paste on Linux machines
ensure you are "splunk" user

SPLUNK_HOME="/opt/splunk"
rm $SPLUNK_HOME/var/run/splunk/splunkd.pid
$SPLUNK_HOME/bin/splunk status
$SPLUNK_HOME/bin/splunk start

edavson
Engager

pretty much what adityapavan18 said above but...

i moved the file '//var/run/splunk/splunkd.pid' to '//var/run/splunk/splunkd.pid.old' then ran '//bin/splunk start'. I guess you can delete the .old file after that.

the new splunkd.pid is created after start is complete

DataOrg
Builder

we can remove or we can rename or we can move to other location the splunk.pid file.
while starting splunkd it will check for the old splunk.pid file if its not there it will create new one and splunkd will be started

0 Karma

adityapavan18
Contributor

Thanks seems to have resolved it after i deleted the splunk.pid file from var/run folder inside splunk.

koshyk
Super Champion

for easier copy paste 🙂

rm $SPLUNK_HOME/var/run/splunk/splunkd.pid
$SPLUNK_HOME/bin/splunk status
$SPLUNK_HOME/bin/splunk start

N92
Path Finder

What's the reason for this? We are facing issue multiple time.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>