Re: "OSError: (12, 'Cannot allocate memory')" aft...

ckorb · ‎04-08-2011

Hi there,

after my first install of splunk 4.2 on Debian and the start without any errors i try to login, wich works but afterwards i get directed to am errorpage everytime:

OSError: (12, 'Cannot allocate memory')

    /opt/splunk/lib/python2.6/subprocess.py, line 1037:
self.pid = os.fork()
/opt/splunk/lib/python2.6/subprocess.py, line 621:
errread, errwrite)
/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/util.py, line 1165:
return subprocess.Popen(*a, **kw)
/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/filechain.py, line 113:
minifier = Popen([PATH_TO_JSMIN], stdin = subprocess.PIPE, stderr = subprocess.STDOUT, stdout = subprocess.PIPE, close_fds = True)
/opt/splunk/share/splunk/search_mrsparkle/templates/lib.html, line 72:
<script type="text/javascript" src="${make_url('/modules/' + basename)}"></script> \
/opt/splunk/share/splunk/search_mrsparkle/templates/layout/view.html, line 74:
# process every module
/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html, line 50:
<%self:js/>
/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html, line 22:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html, line 7:
<%self:render/>
/opt/splunk/lib/python2.6/site-packages/mako/runtime.py, line 633:
callable_(context, *args, **kwargs)
/opt/splunk/lib/python2.6/site-packages/mako/runtime.py, line 607:
_exec_template(inherit, lclcontext, args=args, kwargs=kwargs)
/opt/splunk/lib/python2.6/site-packages/mako/runtime.py, line 575:
**_kwargs_for_callable(callable_, data))
/opt/splunk/lib/python2.6/site-packages/mako/template.py, line 283:
return runtime._render(self, self.callable_, args, data)
/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/__init__.py, line 248:
return templateInstance.render(**template_args)

Has anyone had that before?

Regards

Edit:

ulimit -a

core file size          (blocks, -c) 0
data seg size           (kbytes, -d) unlimited
file size               (blocks, -f) unlimited
pending signals                 (-i) 1024
max locked memory       (kbytes, -l) 32
max memory size         (kbytes, -m) unlimited
open files                      (-n) 1024
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
stack size              (kbytes, -s) 10240
cpu time               (seconds, -t) unlimited
max user processes              (-u) 137216
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited

grep ulimit splunkd:

04-08-2011 14:14:35.280 +0200 INFO  ulimit - Limit: virtual address space size: unlimited
04-08-2011 14:14:35.280 +0200 INFO  ulimit - Limit: data segment size: unlimited
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: resident memory size: unlimited
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: stack size: 10485760 bytes [hard maximum: unlimited]
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: core file size: 0 bytes [hard maximum: unlimited]
04-08-2011 14:14:35.281 +0200 WARN  ulimit - Core file generation disabled
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: data file size: unlimited
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: open files: 1024 files
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: user processes: 137216 processes
04-08-2011 14:14:35.281 +0200 INFO  ulimit - Limit: cpu time: unlimited
04-08-2011 14:16:36.582 +0200 INFO  ulimit - Limit: virtual address space size: unlimited
04-08-2011 14:16:36.582 +0200 INFO  ulimit - Limit: data segment size: unlimited
04-08-2011 14:16:36.582 +0200 INFO  ulimit - Limit: resident memory size: unlimited
04-08-2011 14:16:36.583 +0200 INFO  ulimit - Limit: stack size: 10485760 bytes [hard maximum: unlimited]
04-08-2011 14:16:36.583 +0200 INFO  ulimit - Limit: core file size: 0 bytes [hard maximum: unlimited]
04-08-2011 14:16:36.583 +0200 WARN  ulimit - Core file generation disabled
04-08-2011 14:16:36.583 +0200 INFO  ulimit - Limit: data file size: unlimited
04-08-2011 14:16:36.583 +0200 INFO  ulimit - Limit: open files: 1024 files
04-08-2011 14:16:36.583 +0200 INFO  ulimit - Limit: user processes: 137216 processes
04-08-2011 14:16:36.583 +0200 INFO  ulimit - Limit: cpu time: unlimited

David_Lanstein · ‎04-08-2011

If you hard-reload the page with minification off, does the error go away on that page? Can you tell me what the exact URL of that page, just to be clear?

Stephen_Sorkin · ‎04-08-2011

It looks like this is happening inthe javascript minification code path. You may want to try disabling this (and CSS minification) in etc/system/local/web.conf. In ansy case, this looks like a bug that you should file with Splunk Support.

Stephen_Sorkin · ‎04-08-2011

Ok, this is odd. You should certainly file a support case.

ckorb · ‎04-08-2011

the home screen, everything else like the menu or search/manage/alerts and so on is showing just on the home-screen i still get this error

Stephen_Sorkin · ‎04-08-2011

what do you mean by home-frame?

ckorb · ‎04-08-2011

thx that helped, now i can see everything except the home-frame

Stephen_Sorkin · ‎04-08-2011

You'll have to add a new one. The exact parameters can be found in etc/system/README/web.conf.spec.

ckorb · ‎04-08-2011

i checked that path but there are just the server.conf and the tenants.conf

ckorb · ‎04-08-2011

thx for the fast reply, i added them in the original post

netwrkr · ‎04-08-2011

Are you running SELINUX? What does 'ulimit -a' look like? 'grep ulimit splunkd.log'

"OSError: (12, 'Cannot allocate memory')" after first login

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?