Splunk Enterprise Security

In Splunk Enterprise Security, will you help me fix the following error: "Failed to start KV Store process. See mongod.log and splunkd.log for details."

christianubeda
Path Finder

Hi team!

I need help.

I have these errors from a long time ago but I didn't notice. Everything works but I need to fix these errors.

My version is 6.1.1.

alt text

Thank you!

0 Karma

LukeMurphey
Champion
0 Karma

christianubeda
Path Finder

It didn´t works.

I got this from mongod.log

2018-11-06T20:06:02.952Z I STORAGE [initandlisten]
2018-11-06T20:06:02.952Z I STORAGE [initandlisten] ** WARNING: Readahead for /opt/splunk/var/lib/splunk/kvstore/mongo is set to 4096KB
2018-11-06T20:06:02.952Z I STORAGE [initandlisten] ** We suggest setting it to 256KB (512 sectors) or less
2018-11-06T20:06:02.952Z I STORAGE [initandlisten] ** http://dochub.mongodb.org/core/readahead
2018-11-06T20:06:02.953Z I JOURNAL [initandlisten] journal dir=/opt/splunk/var/lib/splunk/kvstore/mongo/journal
2018-11-06T20:06:02.953Z I JOURNAL [initandlisten] recover : no journal files present, no recovery needed
2018-11-06T20:07:17.756Z I JOURNAL [durability] Durability thread started
2018-11-06T20:07:17.756Z I JOURNAL [journal writer] Journal writer thread started
2018-11-06T20:07:31.258Z I CONTROL [initandlisten] ** WARNING: You are running this process as the root user, which is not recommended.
2018-11-06T20:07:31.258Z I CONTROL [initandlisten]
2018-11-06T20:07:31.260Z I CONTROL [initandlisten]
2018-11-06T20:07:31.260Z I CONTROL [initandlisten] ** WARNING: You are running on a NUMA machine.
2018-11-06T20:07:31.260Z I CONTROL [initandlisten] ** We suggest launching mongod like this to avoid performance problems:
2018-11-06T20:07:31.260Z I CONTROL [initandlisten] ** numactl --interleave=all mongod [other options]
2018-11-06T20:07:31.260Z I CONTROL [initandlisten]
2018-11-06T20:10:59.930Z I CONTROL [signalProcessingThread] got signal 15 (Terminated), will terminate after current cmd ends
2018-11-06T20:10:59.930Z W REPL [signalProcessingThread] ReplicationCoordinatorImpl::shutdown() called before startReplication() finished. Shutting down without cleaning up the replication system

Do you have any ideas?

0 Karma

LukeMurphey
Champion

I recommend opening a case with Support. There are many reasons why KV store might not start and I suspect Support will be able to get to the root cause faster than I can via Answers.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.