Splunk Enterprise Security

Host is frequently down in Linux. How to find the root cause

alexspunkshell
Contributor

Particular host if frequently down in linux. Kindly help me the steps to find the root cause and fix the issue.

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Most likely the ulimits are not set correctly and the splunk daemon is being killed off by the kernel. Verify ulimits are correct, and check network connectivity. If there is latency in the latter, the node may not be down but timing out in reporting health back to the cluster.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...