Security

Session lock files

mslvrstn
Communicator

All of my indexers have thousands of session lock files similar to

-rw-------  1 root   root         0 Jan 27 16:38 session-fa9570368b47a81458a696720fb657239dc0a60c.lock

ls /opt/splunk/var/run/splunk/session*.lock | wc -l
20379

which go back for months.

I don't know that there is anything necessarily wrong with this, but it doesn't feel right. Is this common? If it isn't, what kind of misbehavior should we be on the lookout for?

Tags (2)

johnhsu
Observer

Remove tons of session files
ll | grep session | awk '{print "rm "$8" "}' | csh

Note:
"$8" -- column 8 of ll comand

Thanks
Sincerely
John Hsu

0 Karma

gareth
Splunk Employee
Splunk Employee

Well even with that traffic, the lock files shouldn't be months old; something odd there.

0 Karma

mslvrstn
Communicator

Firstly, thanks for the edit, dwaddle. I see what you did with the indent and I will do that from now on.

Gareth, it's 4.1.6 on Linux. Your question about web_service log was right on target. At first I thought not, since these are indexers and don't get much http traffic, although splunkweb is enabled for convenience. Then I looked at the logs and saw tons of web vulnerability assessment traffic. Understanding that those session files correspond to splunkweb traffic was the key. Thanks!

0 Karma

gareth
Splunk Employee
Splunk Employee

No, that shouldn't happen. Extraneous session and lock files should be purged every five minutes or so.

Which version of Splunk are you running (and on what platform)? Are there any related error messages in the web_service.log?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...