Knowledge Management

Mongodb failing to start

mgrattan
New Member

I am running Splunk 8.0 on a Windows 2012 R2 server. When I start Splunk I am getting the kvstore failed error.
In trying to fix it, I noticed that the server SSL certificate had expired and mongo was not starting.
I generated a new certificate using:

 splunk createssl server-cert -d "C:\Program Files\Splunk\etc\auth" -n server.pem -c BLAH -p

Now, I see the following in the mongodb log:

2019-11-01T19:48:22.804Z W CONTROL  [main] net.ssl.sslCipherConfig is deprecated. It will be removed in a future release.
 2019-11-01T19:48:22.908Z E NETWORK  [main] cannot read PEM key file: C:/Program Files/Splunk/etc/auth/server.pem error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt
 2019-11-01T19:48:22.908Z F CONTROL  [main] Failed global initialization: InvalidSSLConfiguration: Can not set up PEM key file.

My server config file is now:

[general]
serverName = mcso-splunk
pass4SymmKey = $1$hsG8OnpoeonS

[sslConfig]
sslKeysfilePassword = $7$SsDrXmvwh9d+HupPfZFTztNG2YvcX1+WcBVVQxO9dVhD5ToFr26cKYE00yDMJp7P
sslPassword = $7$VDRTGDCLYgi3pWcL3HOLBXZ7TcSFU6z4XONKdCdf/kE29WOaiNOqzIncFPG4S/Ht

[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free

[lmpool:auto_generated_pool_enterprise]
description = auto_generated_pool_enterprise
quota = MAX
slaves = *
stack_id = enterprise

[license]
active_group = Enterprise

Any thoughts would be appreciated, thanks.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust
0 Karma

badrinath_itrs
Communicator

Can you take a backup of server.conf and remove sslKeysfilePassword stanza as this is deprecated and also sslPassword stanza. Restart SPLUNK, it should add the default sslPassword values again.

The error you see is related to bad password on SSL Certificates .

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...