Security

Why does Splunk keep crashing when I try to download software?

mrw5641
New Member

Hello, my Splunk keeps crashing when I try to download software ever since I added in the [proxy_config] and http:// and https:// to the server.conf file...

When its not in there, it doesn't crash.

[proxyConfig]
http_proxy=http://hostname:9997
https_proxy=https://hostname:9997

[build a0c72a66db66] 2018-08-30 12:41:25
Received fatal signal 6 (Aborted).
Cause:
Signal sent by PID 7157 running under UID 0.
Crashing thread: TcpChannelThread

0 Karma

DimasSouza
Path Finder

by definition a port can't be served as http and https at the same time. Try somethin linke this:

if your proxy serves an unencrypted port

[proxyConfig]
http_proxy=http://hostname:<http_port>
https_proxy=http://hostname:<http_port>

OR
if your proxy serves through an encrypted port

[proxyConfig]
http_proxy=https://hostname:<https_port>
https_proxy=https://hostname:<https_port>

Of course, you need a proxy software serving your proxy port...

0 Karma

sebastianstruwe
Explorer

Hi DimasSouza,
this solution didn't work for me. If I use only https in proxyConfig, there is no connection to splunkbase. If I use only http in proxyConfig, splunkd still crashes.

0 Karma

nickhills
Ultra Champion

Is your proxy doing SSL inspection?

If so, you may have problems because the Splunk process will not be able to validate the connection to splunkbase. - This could explain why the connection is failing using SSL

There are several workarounds you could apply, but in my experience request an "inspection-bypass" from your security team was the path of least resistnace, albeit with a business justification.

None of that explains why splunkd crashes with the alternative - that is not something i have seen before.

If my comment helps, please give it a thumbs up!
0 Karma

mrw5641
New Member

Hi MuS, yes that is correct... I changed the proxy port and the server is still crashing...

0 Karma

MuS
SplunkTrust
SplunkTrust

your proxy port is 9997 which normally is the SplunkTCP default port ... is that correct?

cheers, MuS

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.