Splunk Search

is_pid_valid

thiru25
Explorer

I am seeing this error, causing splunk to not start, how can I resolve it?

Operation "is_pid_valid" failed in /opt/splunk/p4/splunk/branches/5.0.2/src/libzero/conf-mutator-locking.c:261, conf_mutator_lock(); Operation not permitted
Conf mutator lockfile has PID 26728, but my PID is 24004; error condition likely.

Tags (2)

andykuhn
Path Finder

In my circumstance, within the /var/run/splunk dir, I had NO .pid file. Otherwise my error and circumstance were identical.

To fix the issue, previous 'session' files were copied to another folder I called 'old_sessions'. Upon restart, with the session data cleared, the pid file regenerated properly and everything looks fine.

0 Karma

gudavasr
Path Finder

In $SPLUNK_HOME/var/run/splunk ..there are files with .pid. One of it is conf-mutator-.pid.
Somehow this file is not deleted when splunk is stopped. Hence this error. To resolve:
1) stop splunk to stop all the process.
2) rename conf-mutator-*.pid
3) start splunk.

Thnak yosu

gudavasr
Path Finder

Hi,

Does any one know solution for this issue? I have the same issue after patching this server.
Can someone please help?

Thank You

0 Karma

droth333
Explorer

Can we get a splunker to comment on this? "Error condition likely",
as in, can you name a few?
This has happened to me too, it can't be that uncommon,
though this issue has low readership.
thanks!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...