Re: "OSError: (12, 'Cannot allocate memory')" aft...

ckorb · ‎04-08-2011

Hi there,

after my first install of splunk 4.2 on Debian and the start without any errors i try to login, wich works but afterwards i get directed to am errorpage everytime:

OSError: (12, 'Cannot allocate memory')

    /opt/splunk/lib/python2.6/subprocess.py, line 1037:
self.pid = os.fork()
/opt/splunk/lib/python2.6/subprocess.py, line 621:
errread, errwrite)
/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/util.py, line 1165:
return subprocess.Popen(*a, **kw)
/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/filechain.py, line 113:
minifier = Popen([PATH_TO_JSMIN], stdin = subprocess.PIPE, stderr = subprocess.STDOUT, stdout = subprocess.PIPE, close_fds = True)
/opt/splunk/share/splunk/search_mrsparkle/templates/lib.html, line 72:
<script type="text/javascript" src="${make_url('/modules/' + basename)}"></script> \
/opt/splunk/share/splunk/search_mrsparkle/templates/layout/view.html, line 74:
# process every module
/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html, line 50:
<%self:js/>
/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html, line 22:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html, line 7:
<%self:render/>
/opt/splunk/lib/python2.6/site-packages/mako/runtime.py, line 633:
callable_(context, *args, **kwargs)
/opt/splunk/lib/python2.6/site-packages/mako/runtime.py, line 607:
_exec_template(inherit, lclcontext, args=args, kwargs=kwargs)
/opt/splunk/lib/python2.6/site-packages/mako/runtime.py, line 575:
**_kwargs_for_callable(callable_, data))
/opt/splunk/lib/python2.6/site-packages/mako/template.py, line 283:
return runtime._render(self, self.callable_, args, data)
/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/__init__.py, line 248:
return templateInstance.render(**template_args)

Has anyone had that before?

Regards

Edit:

ulimit -a

core file size          (blocks, -c) 0
data seg size           (kbytes, -d) unlimited
file size               (blocks, -f) unlimited
pending signals                 (-i) 1024
max locked memory       (kbytes, -l) 32
max memory size         (kbytes, -m) unlimited
open files                      (-n) 1024
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
stack size              (kbytes, -s) 10240
cpu time               (seconds, -t) unlimited
max user processes              (-u) 137216
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited

grep ulimit splunkd:

04-08-2011 14:14:35.280 +0200 INFO  ulimit - Limit: virtual address space size: unlimited
04-08-2011 14:14:35.280 +0200 INFO  ulimit - Limit: data segment size: unlimited
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: resident memory size: unlimited
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: stack size: 10485760 bytes [hard maximum: unlimited]
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: core file size: 0 bytes [hard maximum: unlimited]
04-08-2011 14:14:35.281 +0200 WARN  ulimit - Core file generation disabled
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: data file size: unlimited
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: open files: 1024 files
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: user processes: 137216 processes
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: cpu time: unlimited
04-08-2011 14:16:36.582 +0200 INFO  ulimit - Limit: virtual address space size: unlimited
04-08-2011 14:16:36.582 +0200 INFO  ulimit - Limit: data segment size: unlimited
04-08-2011 14:16:36.582 +0200 INFO  ulimit - Limit: resident memory size: unlimited
04-08-2011 14:16:36.583 +0200 INFO  ulimit - Limit: stack size: 10485760 bytes [hard maximum: unlimited]
04-08-2011 14:16:36.583 +0200 INFO  ulimit - Limit: core file size: 0 bytes [hard maximum: unlimited]
04-08-2011 14:16:36.583 +0200 WARN  ulimit - Core file generation disabled
04-08-2011 14:16:36.583 +0200 INFO  ulimit - Limit: data file size: unlimited
04-08-2011 14:16:36.583 +0200 INFO  ulimit - Limit: open files: 1024 files
04-08-2011 14:16:36.583 +0200 INFO  ulimit - Limit: user processes: 137216 processes
04-08-2011 14:16:36.583 +0200 INFO  ulimit - Limit: cpu time: unlimited

David_Lanstein · ‎04-08-2011

If you hard-reload the page with minification off, does the error go away on that page? Can you tell me what the exact URL of that page, just to be clear?

Stephen_Sorkin · ‎04-08-2011

It looks like this is happening inthe javascript minification code path. You may want to try disabling this (and CSS minification) in etc/system/local/web.conf. In ansy case, this looks like a bug that you should file with Splunk Support.

Stephen_Sorkin · ‎04-08-2011

Ok, this is odd. You should certainly file a support case.

ckorb · ‎04-08-2011

the home screen, everything else like the menu or search/manage/alerts and so on is showing just on the home-screen i still get this error

Stephen_Sorkin · ‎04-08-2011

what do you mean by home-frame?

ckorb · ‎04-08-2011

thx that helped, now i can see everything except the home-frame

Stephen_Sorkin · ‎04-08-2011

You'll have to add a new one. The exact parameters can be found in etc/system/README/web.conf.spec.

ckorb · ‎04-08-2011

i checked that path but there are just the server.conf and the tenants.conf

ckorb · ‎04-08-2011

thx for the fast reply, i added them in the original post

netwrkr · ‎04-08-2011

Are you running SELINUX? What does 'ulimit -a' look like? 'grep ulimit splunkd.log'

"OSError: (12, 'Cannot allocate memory')" after first login

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

May 2026 Splunk Expert Sessions: Security & Observability

Network to App: Observability Unlocked [May & June Series]

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Join the Conversation