Can't access web interface due to ExecProcessor error.

[sainzu]

I am unable to access the web interface anymore. Firefox displays "The connection was reset" error.

I looked at splunkd.log and found following errors reported in excess of multiple times:

05-24-2011 16:27:49.484 -0400 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/unix/bin/interfaces.sh" awk: line 1: syntax error at or near ,
05-24-2011 16:27:49.484 -0400 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/unix/bin/interfaces.sh" awk: line 1: syntax error at or near else
05-24-2011 16:27:49.484 -0400 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/unix/bin/interfaces.sh" awk: line 1: syntax error at or near }

Can anyone point me to a solution? Not sure what went wrong. This installation was working fine few weeks ago.

Splunk is installed in a debian box running apache2.

[dwaddle]

I would say on the surface the two are not related. The ExecProcessor errors are from a splunkd scripted input. The web interface (Splunkweb) runs in a different process than splunkd. I would probably start with these:

1. Is splunkweb running? ps -ef | grep mrsparkle
2. Is splunkweb listening on the expected port? netstat -antp | egrep LISTEN.*python
3. Is there anything interesting in splunkweb.log?

Firefox also displays this error if you try to access and HTTPS-enabled splunkweb using an http:// URL. If your splunkweb is configured to use HTTPS, make sure you are using an https:// URL.

[dwaddle]

y'welcome -- if you would, please mark the answer as "accepted" by clicking the little checkbox on the left. That'll take it out of the unanswered list.

[sainzu]

That was it. It works on https. I never noticed whether Splunk ran on https or http before. I have never made any changes to that configuration anytime.

Thanks a lot for your help mr.dwaddle 🙂

[dwaddle]

Odd question - did someone configure SplunkWeb to use SSL? I get the same "The connection was reset" out of firefox when I try to access my https splunkweb with an http:// URL.

[sainzu]

I don't see anything alarming in web_access.log and web_service.log. Any other way to trouble shoot this problem?

[dwaddle]

Ah, I had the logfile names wrong. My apologies. The interesting logs would be web_access.log and web_service.log.

[sainzu]

Here are the results:

debian:/opt/splunk/var/log/splunk# ps -ef | grep mrsparkle
root     19137     1  0 16:24 ?        00:00:02 python -O /opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/root.py start
root     26650  4181  0 16:48 pts/0    00:00:00 grep mrsparkle

debian:/opt/splunk/var/log/splunk# netstat -antp | egrep LISTEN.*python
tcp        0      0 0.0.0.0:8000            0.0.0.0:*               LISTEN      19137/python

I dont see a splunkweb.log but if you mean ../var/log/splunk/web_access.log, the last logged message is from Apr 20. That's probably when I check it last.