Installation

what are the consequences of not running as bash on linux

yannK
Splunk Employee
Splunk Employee

I saw this article in the manual
http://docs.splunk.com/Documentation/Splunk/6.2.5/Installation/InstallonLinux#Default_shell

Default shell
Splunk Enterprise assumes you are using the bash shell.
Using the dash shell can result in zombie processes.

I am using ubuntu or debian, using dash as default, what would be the consequences ?

Tags (1)
1 Solution

yannK
Splunk Employee
Splunk Employee

The problem is that on "dash" shell, the processes created by splunk for scripted inputs will not be terminated when you restart splunk, or when the new script run starts.

By example with the AWS app, you may see many processes like

ps -aux | grep splunk
python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudwatch.py   

that will be running for a long time (even prior to the last splunk restart)
and ultimately exhaust resources on the box.

This does not happen since I run splunk under a bash shell.
Be careful on debian like OS (debian, and ubunbu)

View solution in original post

yannK
Splunk Employee
Splunk Employee

The problem is that on "dash" shell, the processes created by splunk for scripted inputs will not be terminated when you restart splunk, or when the new script run starts.

By example with the AWS app, you may see many processes like

ps -aux | grep splunk
python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudwatch.py   

that will be running for a long time (even prior to the last splunk restart)
and ultimately exhaust resources on the box.

This does not happen since I run splunk under a bash shell.
Be careful on debian like OS (debian, and ubunbu)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...