Help me to restart splunk UF agent!!!

[yamini_37]

Hi All,

I am trying to restart the Splunk UF agent in my Linux server, but it is throwing the following error.

"Removing stale pid file... Can't unlink pid file "/opt/ca/splunk/splunkforwarder/var/run/splunk/splunkd.pid": Read-only file system"

My splunkd.pid file permission set as following:

-rw-r----- splunk splunk splunkd.pid

The agent was not running since 2 weeks and I did not make any changes lately. I have no clue why it is throwing that error. Could someone please help me to fix this issue.

Thanks in advance.

[richgalloway]

The problem is not with the splunkd.pid file.  The problem is with the file system containing the splunkd.pid file.  Something has made that file system read-only so Splunk can't touch the .pid file.  Fix the file system and Splunk should run again.  Talk to your Linux admin.

[yamini_37]

Thanks @richgalloway . I tried to remove/ rename splunkd.pid and I was getting read only file error as noted below. But the file permissions seems to be good. 

[splunk@host]$ rm splunkd.pid
rm: cannot remove âsplunkd.pidâ: Read-only file system
[splunk@host]$ mv splunkd.pid splunkd.pid_bkp
mv: cannot move âsplunkd.pidâ to âsplunkd.pid_bkpâ: Read-only file system

Could you please tell the way forward in order to fix this issue

[richgalloway]

A read-only file system is not a permissions problem - it's a file system problem.  You should talk to your favorite Linux admin (I am not one) about how to correct it.  If you don't have a Linux admin then try Google.

[yamini_37]

Okay @richgalloway . Thank you.