Hi All,
I am trying to restart the Splunk UF agent in my Linux server, but it is throwing the following error.
"Removing stale pid file... Can't unlink pid file "/opt/ca/splunk/splunkforwarder/var/run/splunk/splunkd.pid": Read-only file system"
My splunkd.pid file permission set as following:
-rw-r----- splunk splunk splunkd.pid
The agent was not running since 2 weeks and I did not make any changes lately. I have no clue why it is throwing that error. Could someone please help me to fix this issue.
Thanks in advance.
The problem is not with the splunkd.pid file. The problem is with the file system containing the splunkd.pid file. Something has made that file system read-only so Splunk can't touch the .pid file. Fix the file system and Splunk should run again. Talk to your Linux admin.
Thanks @richgalloway . I tried to remove/ rename splunkd.pid and I was getting read only file error as noted below. But the file permissions seems to be good.
[splunk@host]$ rm splunkd.pid
rm: cannot remove âsplunkd.pidâ: Read-only file system
[splunk@host]$ mv splunkd.pid splunkd.pid_bkp
mv: cannot move âsplunkd.pidâ to âsplunkd.pid_bkpâ: Read-only file system
Could you please tell the way forward in order to fix this issue
A read-only file system is not a permissions problem - it's a file system problem. You should talk to your favorite Linux admin (I am not one) about how to correct it. If you don't have a Linux admin then try Google.
Okay @richgalloway . Thank you.