Security
Highlighted

Why does Splunk keep crashing when I try to download software?

New Member

Hello, my Splunk keeps crashing when I try to download software ever since I added in the [proxy_config] and http:// and https:// to the server.conf file...

When its not in there, it doesn't crash.

[proxyConfig]
httpproxy=http://hostname:9997
https
proxy=https://hostname:9997

[build a0c72a66db66] 2018-08-30 12:41:25
Received fatal signal 6 (Aborted).
Cause:
Signal sent by PID 7157 running under UID 0.
Crashing thread: TcpChannelThread

0 Karma
Highlighted

Re: Why does Splunk keep crashing when I try to download software?

SplunkTrust
SplunkTrust

your proxy port is 9997 which normally is the SplunkTCP default port ... is that correct?

cheers, MuS

0 Karma
Highlighted

Re: Why does Splunk keep crashing when I try to download software?

New Member

Hi MuS, yes that is correct... I changed the proxy port and the server is still crashing...

0 Karma
Highlighted

Re: Why does Splunk keep crashing when I try to download software?

Path Finder

by definition a port can't be served as http and https at the same time. Try somethin linke this:

if your proxy serves an unencrypted port

[proxyConfig]
http_proxy=http://hostname:<http_port>
https_proxy=http://hostname:<http_port>

OR
if your proxy serves through an encrypted port

[proxyConfig]
http_proxy=https://hostname:<https_port>
https_proxy=https://hostname:<https_port>

Of course, you need a proxy software serving your proxy port...

0 Karma
Highlighted

Re: Why does Splunk keep crashing when I try to download software?

Hi DimasSouza,
this solution didn't work for me. If I use only https in proxyConfig, there is no connection to splunkbase. If I use only http in proxyConfig, splunkd still crashes.

0 Karma
Highlighted

Re: Why does Splunk keep crashing when I try to download software?

Ultra Champion

Is your proxy doing SSL inspection?

If so, you may have problems because the Splunk process will not be able to validate the connection to splunkbase. - This could explain why the connection is failing using SSL

There are several workarounds you could apply, but in my experience request an "inspection-bypass" from your security team was the path of least resistnace, albeit with a business justification.

None of that explains why splunkd crashes with the alternative - that is not something i have seen before.

0 Karma