Search Head getting crashed

[anandhalagarasa]

Our Primary search head got crashed twice today. When cross verified we found out this is the error message in Crash.log so how should we need to fix it asap.

Error Message:
Received fatal signal 6 (Aborted).
Cause:
Signal sent by PID xxx36 running under UID 99xx.
Crashing thread: IdataDO_Collector

[sudosplunk]

Hi there,
Just making sure, did you check the following conditions,

Having enough disk space - For linux,du -sh $SPLUNK_HOME/
Any user running expensive searches - If you've configured Monitoring console, you can navigate to search -> Activity -> Search Activity: Instance OR go to Jobs Manager page.

[jkat54]

See if this helps:
https://answers.splunk.com/answers/330827/after-upgrade-from-62-to-63-unable-to-start-splunk.html

vranjith009 · Dec 07, 2015 at 10:25 PM
Thanks mfrost8 for your reply.

Error was due to some permission issue of audit db files and "indexes.conf" . Given splunk:splunk permission to all audit db buckets and tracing of bad index conf file by using "./splunk cmd btool indexes list --debug|more" help us for closing the issue.

[deepashri_123]

Hey@anandhalagarasan,

What version of splunk are you using?

[anandhalagarasa]

Splunk 6.5.0 (build 59c8927def0f)