Is there a way to automate splunk forwarder service restart on windows workstations as well as linux when they are down?

[Roy_9]

Hello,

Can someone please help me with your inputs whenever the splunkd.exe and splunk-winevtlog.exe  goes down? looking to set up something automatically restart these services whenever they are down.

Thanks

[isoutamo]

Hi

In Windows there is standard options on service configuration where you can set what happening if service crashed or goes down. Just select restart and also how many times is can try that to avoid @gcusello notice that it's good to get reason for that instead of just restart it again and again.

On linux you should use systemd to start service and let it manage that as in windows. Here is one link where it has described. https://ma.ttias.be/auto-restart-crashed-service-systemd/

Anyhow if UF goes down regularly you must solve the reason for that.

r. Ismo

[splunkreal]

Hello, you could schedule task to check status and restart with script : https://community.splunk.com/t5/Splunk-Search/Good-unix-way-check-if-splunkd-and-splunkweb-are-runni...

[gcusello]

Hi @Roy_9,

are you sure that an automatic restart is the best solution?

I'd like to be informed when an UF is doen so I'd be able to analyze why it went down, not to performa an automatic restart that probably will down again because there's an issue!

Ciao.

Giuseppe