Monitoring Splunk

Is there a way to automate splunk forwarder service restart on windows workstations as well as linux when they are down?

Roy_9
Motivator

Hello,

Can someone please help me with your inputs whenever the splunkd.exe and splunk-winevtlog.exe  goes down? looking to set up something automatically restart these services whenever they are down.

 

 

Thanks

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

In Windows there is standard options on service configuration where you can set what happening if service crashed or goes down. Just select restart and also how many times is can try that to avoid @gcusello notice that it's good to get reason for that instead of just restart it again and again.

On linux you should use systemd to start service and let it manage that as in windows. Here is one link where it has described. https://ma.ttias.be/auto-restart-crashed-service-systemd/

Anyhow if UF goes down regularly you must solve the reason for that.

r. Ismo

0 Karma

splunkreal
Motivator

Hello, you could schedule task to check status and restart with script : https://community.splunk.com/t5/Splunk-Search/Good-unix-way-check-if-splunkd-and-splunkweb-are-runni...

 

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Roy_9,

are you sure that an automatic restart is the best solution?

I'd like to be informed when an UF is doen so I'd be able to analyze why it went down, not to performa an automatic restart that probably will down again because there's an issue!

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...