Saved Searches fail to generate PDF attachment for email

[allencb]

We're running 4.1.7 under CentOS 64bit. With the PDF server installed, we can't get PDFs generated as attachments to emailed search results (CSV files are attached and delivered). We get the following error message:

2011-03-18 15:34:53,117 ERROR   pdfhandler:662 - (500) Failed to generate a report using Firefox: [startup] Successful startup
2011-03-18 15:34:53,117 ERROR (500) Failed to generate a report using Firefox: [startup] Successful startup
2011-03-18 15:34:53,118 WARNING xvfb:132 - Stopping X Server 5
2011-03-18 15:34:53,118 WARNING Stopping X Server 5
2011-03-18 15:34:53,161 ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: PDF server at /services/pdfserver/renderpdf returned error: Failed to generate a report using Firefox: [startup] Successful startup

Every dependency check I can find on this site has been successful. I've increased the timeout value as well. I've even tried very short and simple queries to limit processing time.

Any ideas?

Edit to add: When using the test tool under the Manager, I get a grey box where the PDF is supposed to display, but python.log shows the following:

2011-03-18 17:39:26,724 INFO    pdfhandler:550 - Starting PDF App Renderer Version 1.2-2
2011-03-18 17:39:26,724 INFO Starting PDF App Renderer Version 1.2-2
2011-03-18 17:39:26,751 INFO    xvfb:45 - Started new X server. Now 1 active
2011-03-18 17:39:26,751 INFO Started new X server. Now 1 active
2011-03-18 17:39:26,757 INFO    xvfb:205 - Assigned DISPLAY :5
2011-03-18 17:39:26,757 INFO Assigned DISPLAY :5
2011-03-18 17:39:26,757 INFO    xvfb:115 - Starting X Server: ['/usr/bin/Xvfb', ':5', '-screen', '0', '3000x768x24', '-nolisten', 'tcp']
2011-03-18 17:39:26,757 INFO Starting X Server: ['/usr/bin/Xvfb', ':5', '-screen', '0', '3000x768x24', '-nolisten', 'tcp']
2011-03-18 17:39:26,758 INFO    xvfb:116 - Starting X Server env: {'XAUTHORITY': '/opt/splunk/var/run/splunk/xvfb/xauth-5/Xauthority'}
2011-03-18 17:39:26,758 INFO Starting X Server env: {'XAUTHORITY': '/opt/splunk/var/run/splunk/xvfb/xauth-5/Xauthority'}
2011-03-18 17:39:28,759 INFO    xvfb:122 - X Started
2011-03-18 17:39:28,759 INFO X Started
2011-03-18 17:39:36,793 WARNING pdfhandler:329 - Created profile /tmp/tmpT77I6c/.mozilla/firefox/kv0lfbhz.splunk
2011-03-18 17:39:36,793 WARNING Created profile /tmp/tmpT77I6c/.mozilla/firefox/kv0lfbhz.splunk
2011-03-18 17:39:36,798 INFO    pdfhandler:466 - Executing /opt/splunk/etc/apps/pdfserver/bin/firefox-x86_64/firefox -print https://127.0.0.1:443/debug/pdf_echo -printmode pdf -printfile /tmp/tmpKwTXiB -title https://127.0.0.1:443/debug/pdf_echo -orientation portrait -paperwidth 216 -paperheight 279 -mode default -timeout 480 -windowsize 1200x768 -cookie session_id_443=0069c71c89dbcf8128b334bfee63fef87ee849a8 -P splunk
2011-03-18 17:39:36,798 INFO Executing /opt/splunk/etc/apps/pdfserver/bin/firefox-x86_64/firefox -print https://127.0.0.1:443/debug/pdf_echo -printmode pdf -printfile /tmp/tmpKwTXiB -title https://127.0.0.1:443/debug/pdf_echo -orientation portrait -paperwidth 216 -paperheight 279 -mode default -timeout 480 -windowsize 1200x768 -cookie session_id_443=0069c71c89dbcf8128b334bfee63fef87ee849a8 -P splunk

Chris

[allencb]

za3ph0d, it was resolved by us. There was a dependency that wasn't being met, but also didn't generate a specific error. We installed Curl and that resolved the issue.

kjcorbin, we forced it to use the 64bit version by renaming the 32bit Firefox folder to something else, this forces the system to default to the 64bit version.

[0waste_splunk]

What is curl? can you please list the steps? which resolved this problem?

thanks

[kjcorbin]

Was this ever resolved. I am having a similar issue where libfontconfig.so.1 is not found by firefox-bin under firefox-i386. However firefox-bin under firefox-x86_64 is able to find the library correctly. So it lok slike for some reason pdf server is always trying to use the 32 bit version even when the os is 64 bit.

However, at this point I am pretty stuck since there appears to be no way to configure pdf server to use the 64 bit version of firefox.

[za3ph0d]

Was this ever resolved? I am having the exact same issue running Ubuntu 11.04 64 bit server, splunk 4.2.1 and pdfreporter 1.2. Everything looks like it runs fine but then I get the error: ERROR pdfhandler:662 - (500) Failed to generate a report using Firefox: [startup] Successful startup

[gareth]

That output is odd and unexpected - It would if you could contact support and supply:

• The python.log with debug enabled - Edit $SPLUNK_HOME/etc/log.cfg and change "splunk = INFO" to "splunk = DEBUG" at the bttom of the file; no restart is required.
• The version of CentOS you're running
• The version of Splunk you're running
• A list of installed packages from running rpm -qa

It would also be useful to know if you experience the same result with SSL turned off on the search head.