Monitoring Splunk

How do I start Splunk after it stopped responding with ERROR ProcessRunner?

abhijitnath89bm
New Member

I received the below error. Now, none of the Splunk start or stop commands are responding. Please let us know how we will bring Splunk back to life.

03-01-2019 09:05:15.702 -0500 FATAL ProcessRunner - Unexpected EOF from process runner child!
03-01-2019 09:05:15.702 -0500 ERROR ProcessRunner - helper process seems to have died (child killed by signal 15: Terminated)!  
Tags (2)
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

The linux OOM (out-of-memory) killer probably killed the Splunk search process. You should run this command to see if the OOM killer is occuring:

dmesg -T| grep 'illed process'

If this returns results it means you don't have enough system memory for what you are trying to do.

All the best.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...