Security

Splunk web can not start

whitelord90
Explorer

Hello,
For some reason, splunkweb fails to start in first, my version is 4.2.1 any ideas where i can look for to troubleshoot:

This appears to be your first time running this version of Splunk.
Copying '/opt/splunk/etc/openldap/ldap.conf.default' to '/opt/splunk/                       etc/openldap/ldap.conf'.
Generating RSA private key, 1024 bit long modulus
............++++++
...............++++++
e is 65537 (0x10001)
writing RSA key

Generating RSA private key, 1024 bit long modulus
........................++++++
.......................................++++++
e is 65537 (0x10001)
writing RSA key

Moving '/opt/splunk/share/splunk/search_mrsparkle/modules.new' to '/o                       pt/splunk/share/splunk/search_mrsparkle/modules'.

Splunk> CSI: Logfiles.

Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking configuration...  Done.
        Checking index directory...
        Creating: /opt/splunk/var/lib/splunk
        Creating: /opt/splunk/var/lib/splunk/appserver/i18n
        Creating: /opt/splunk/var/lib/splunk/appserver/modules/static                       /css
        Creating: /opt/splunk/var/run/splunk
        Creating: /opt/splunk/var/run/splunk/upload
        Creating: /opt/splunk/var/spool/splunk
        Creating: /opt/splunk/var/spool/dirmoncache
        Creating: /opt/splunk/var/lib/splunk/authDb
        Creating: /opt/splunk/var/lib/splunk/hashDb
        Validated databases: _audit _blocksignature _internal _thefis                       hbucket history main summary
        Done
New certs have been generated in '/opt/splunk/etc/auth'.
Success
        Checking conf files for typos...
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
                                                           [  OK  ]
Done.Starting splunkweb... /opt/splunk/etc/auth/splunkweb does not ex                       ist. Will create
Generating certs for splunkweb server
Generating a 1024 bit RSA private key
.....++++++
...........................++++++
writing new private key to 'privKeySecure.pem'
-----
Signature ok
subject=/CN=xxx.xxx@xxx/O=SplunkUser
Getting CA Private Key
writing RSA key
Error starting splunkweb.                                  [FAILED]

I read topic: http://www.splunk.com/support/forum:SplunkAdministration/2625

I have startwebserver = 1 in /opt/splunk/etc/system/local/web.conf. Please help me.
Thanks

Tags (1)

whitelord90
Explorer

NO, I am completely new installation. Maybe my OS lost some lib or something... 😞

0 Karma

whitelord90
Explorer

Thanks your help,
In web_service.log, i have some error:
+355 ERROR[4dc6c00e22a47ffcc] root:133 - ENGINE: Error in 'start' listener >
+357 ERROR[4dc6c00e22a47ffcc] custompidfile:43 - Unable to remove /opt/splunk/var/run/splunk/splunkweb.pid. [[Errno 2] No such file or directory: '/opt/splunk/var/run/splunk/splunkweb.pid']
+,357 ERROR[4dc6c00e22a47ffcc] root:493 - Unable to start splunkweb
+358 ERROR[4dc6c00e22a47ffcc] root:494 - can't start new thread
my log in : http://www.mediafire.com/?4b0c6e6svrb68z7

0 Karma

proctorgeorge
Path Finder

Have you recently upgraded to v4.2.1 from a previous Splunk version?

I had a similar problem when I upgraded with the wrong user account (a different one then I used to originally install).

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

Are you seeing any errors in your web_service.log or splunkd.log files inside of $SPLUNK_HOME/var/log/splunk at the time when you see this failure?

If so, it would be a good idea to edit your post to include what you are seeing in those files.

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!