After upgrading our splunk server to 4.3 from 4.2.5 splunkd crashes with the following errors in splunkd_stderr.log:
2012-01-11 11:01:27.098 +0800 splunkd started (build 115073) terminate called after throwing an instance of 'PropertyPagesException' what(): Cannot get user to act as: No user info provider registered (user: xxxx, app: user-prefs, root: /opt/splunk/etc)
Running on CentOS 5.7 64-bit, dual Quad Core Xeon with 8GB RAM.
We will at least need to look at the corresponding crash log and at what is logged at the time of the crash in splunkd.log in order to comment. I would strongly recommend that you log a support case and attach a Splunk diag to get this crash analyzed. It doesn't seem likely that we'll be able to determine the cause of the problem just from the information provided so far.
I believe you are experiencing a crash that was discovered just today and filed as a bug with reference SPL-47232.
The signature of this crash is as follows :
$SPLUNKHOME/var/run/splunk/dispatch). The crashing thread is indicated at the very beginning of the crash log file that can be found in
[build 115073] 2012-01-12 14:54:12 <==
Received fatal signal 6 (Aborted).
Signal sent by PID 28468 running under UID 0.
Crashing thread: DispatchReaperCrashing thread: DispatchReaper
$SPLUNKHOME/var/log/splunk/splunkdstderr.log) will contain the following error:
terminate called after throwing an instance of 'PropertyPagesException'
what(): Cannot get user to act as: No user info provider registered (user: splunk-system-user, app: user-prefs, root: /opt/splunk/etc)
Until this crash is fixed in an upcoming release, you'll have to take the following steps to allow splunkd to start again:
rm -rf $SPLUNK_HOME/var/run/splunk/dispatch/*
Note: If you are unfamiliar with the search dispatch directory, it is the location where Splunk stores search artifacts for past and currently running searches. That data is volatile by nature and can be regenerated by re-running the searches that generated it.
This is the exact error that we had faced. Interestingly our Splunk instance started working of its' own accord after a couple of hours.