Splunk Enterprise

Help me to restart splunk UF agent!!!

yamini_37
Path Finder

Hi All,

I am trying to restart the Splunk UF agent in my Linux server, but it is throwing the following error.

"Removing stale pid file... Can't unlink pid file "/opt/ca/splunk/splunkforwarder/var/run/splunk/splunkd.pid": Read-only file system"

My splunkd.pid file permission set as following:

-rw-r----- splunk splunk splunkd.pid

The agent was not running since 2 weeks and I did not make any changes lately. I have no clue why it is throwing that error. Could someone please help me to fix this issue.

Thanks in advance.

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The problem is not with the splunkd.pid file.  The problem is with the file system containing the splunkd.pid file.  Something has made that file system read-only so Splunk can't touch the .pid file.  Fix the file system and Splunk should run again.  Talk to your Linux admin.

---
If this reply helps you, Karma would be appreciated.

yamini_37
Path Finder

Thanks @richgalloway . I tried to remove/ rename splunkd.pid and I was getting read only file error as noted below. But the file permissions seems to be good. 

[splunk@host]$ rm splunkd.pid
rm: cannot remove âsplunkd.pidâ: Read-only file system
[splunk@host]$ mv splunkd.pid splunkd.pid_bkp
mv: cannot move âsplunkd.pidâ to âsplunkd.pid_bkpâ: Read-only file system

Could you please tell the way forward in order to fix this issue

0 Karma

richgalloway
SplunkTrust
SplunkTrust

A read-only file system is not a permissions problem - it's a file system problem.  You should talk to your favorite Linux admin (I am not one) about how to correct it.  If you don't have a Linux admin then try Google.

---
If this reply helps you, Karma would be appreciated.
0 Karma

yamini_37
Path Finder

Okay @richgalloway . Thank you.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...