Security

splunkweb arbitrary crashing

aphextwin
New Member

Hi Folks
Been scratching my head on this....any help is appreciated!

Issue:
splunkweb crashes for unknown reason at random times. usually happens when a new login session is initiated

Some background:
Splunk version -4.3 build 115073
OS: Mac OS 10.6 Server
Setup: Windows heavy-forwarder sending to MacOSX indexer. HTTP running only on indexer.

web_service.log:
2012-03-15 11:53:21,934 INFO [4f6167b1ee72e1c70] decorators:321 - require_login - no splunkd sessionKey variable set; cherrypy_session=1562893fce4233c5947f6dd9cf1b53c434f8f279 request_path=/en-US/
2012-03-15 11:53:21,934 INFO [4f6167b1ee72e1c70] decorators:328 - require_login - redirecting to login
2012-03-15 11:53:28,617 INFO [4f6167b88a2aafb90] account:209 - user=XXXXXXXX action=login status=success session=9966eadb5d6bd2051ea9a8f6bc63c160 reason=user-initiated useragent="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; MS-RTC LM 8; InfoPath.2; .NET4.0E; Zune 4.7)" clientip=10.176.5.193
2012-03-15 11:53:28,648 INFO [4f6167b8a57a431f0] cached:77 - memoized decorator used on function with non hashable arguments
2012-03-15 11:53:28,779 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "search_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "search_detail_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "search_user_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "search_ui_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "index_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "index_status_health" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "indexing_volume" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "splunkd_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "splunkweb_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "inputs_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "scheduler_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,782 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "scheduler_user_app" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,782 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "scheduler_savedsearch" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,782 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "scheduler_status_errors" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,782 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "pdf_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,793 INFO [4f6167b8ca2aafdd0] cached:77 - memoized decorator used on function with non hashable arguments
2012-03-15 11:53:28,885 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "search_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,885 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "search_detail_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "search_user_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "search_ui_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "index_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "index_status_health" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "indexing_volume" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "splunkd_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "splunkweb_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "inputs_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "scheduler_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "scheduler_user_app" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,888 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "scheduler_savedsearch" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,888 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "scheduler_status_errors" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,888 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "pdf_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:29,034 INFO [4f6167b8ca2aafdd0] view:1056 - PERF - viewTime=0.0981s templateTime=0.143s
2012-03-15 11:53:29,187 ERROR [4f4a50173e17af970] root:133 - ENGINE: Error in HTTP server: shutting down
Traceback (most recent call last):
File "/Applications/splunk/lib/python2.7/site-packages/cherrypy/process/servers.py", line 73, in start_http_thread
self.httpserver.start()
File "/Applications/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/
init.py", line 1692, in start
self.tick()
File "/Applications/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/
init.py", line 1745, in tick
s, addr = self.socket.accept()
File "/Applications/splunk/lib/python2.7/ssl.py", line 347, in accept
suppress_ragged_eofs=self.suppress_ragged_eofs),
File "/Applications/splunk/lib/python2.7/ssl.py", line 121, in __init
_
socket.getpeername(self)
File "/Applications/splunk/lib/python2.7/socket.py", line 224, in meth
return getattr(self._sock,name)(*args)
error: [Errno 22] Invalid argument

Tags (2)
0 Karma

melting
Splunk Employee
Splunk Employee

Looks like CherryPy is having trouble when sockets are closed unexpectedly. Thanks for letting us know. If you continue to have this problem I would suggest filing a case with support.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...