Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- splunkd crash
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunkd crash
Splunkd has crashed a couple of times now.
The only thing I see in splunkd.log is some log WARNS
eg.
12-09-2013 07:55:09.879 +0100 WARN HttpListener - Socket error from 10.101.11.1
02 while accessing /services/data/indexes: Broken pipe
and a lot of ->
12-09-2013 08:03:17.651 +0100 WARN HttpListener - HTTP active connections down to 330, unthrottling
Is there some configuration that needs to be set different - or ??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Install S.O.S. Then monitor the buggy system for RAM usage. Certain Operating Systems just kill the process when they run out of Memory, and since Splunk "didn't do it", no event is written.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Instead of throwing resources at it do as the respondent suggested - use some system level diagnostic tools to find the cause. You don't mention operating system distribution or release number.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tripled the ram on the box - lets see if this helps splunkd from being killed by linux.
I still see the warn logs
12-09-2013 14:44:59.219 +0100 WARN HttpListener - HTTP active connections down to 330, unthrottling
Any hints on the reason for this ??
Best,
Preben
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is no crash log, and the only resent error I can find in splunkd.log is
12-04-2013 19:00:36.639 +0100 ERROR ProcessRunner - helper process seems to have died (child killed by signal 9: Killed)!
Other that that there is only the WARN's that seems a bit worrying.
best,
Preben
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
have you checked the crash logs, and the splunkd_stderr.log? They may reveal more info.
/k
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Splunk Community Badges!
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
