Splunk Enterprise Security

Host is frequently down in Linux. How to find the root cause

Path Finder

Particular host if frequently down in linux. Kindly help me the steps to find the root cause and fix the issue.

0 Karma


Most likely the ulimits are not set correctly and the splunk daemon is being killed off by the kernel. Verify ulimits are correct, and check network connectivity. If there is latency in the latter, the node may not be down but timing out in reporting health back to the cluster.

0 Karma