Can't get to the web UI and during restart we are getting
Timed out waiting for splunkweb to stop. [FAILED]
splunkweb is already running. [FAILED]
trying to restart splunkweb returns the same errors.
Can find lots of info about splunkweb NOT starting, but not much on a timed out shutdown. Any suggestions? web_service.log shows the following:
2011-10-11 22:52:12,933 ERROR [4e9500dced2aaaaccb4710] utility:59 - name=javascript, class=Splunk.Error, lineNumber=0, message=uncaught exception: [Exception... "Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIXMLHttpRequest.status]" nsresult: "0x80040111 (NS_ERROR_NOT_AVAILABLE)" location: "JS frame :: https://10.20.72.89:8000/enUS/static/@101277.2/js/common.min.js :::: line 13066" data: no], fileName= 2011-10-11 22:59:16,043 ERROR [4e9502840a2aaaaccc8550] utility:59 - name=javascript, class=Splunk.Error, lineNumber=8234, message=response is null, fileN ame=https://10.20.72.89:8000/en-US/static/@101277.2/js/common.min.js 2011-10-12 08:21:50,861 INFO [4e94386bc81a2b2550] root:133 - ENGINE: Caught signal SIGTERM. 2011-10-12 08:21:50,861 INFO [4e94386bc81a2b2550] root:133 - ENGINE: Bus STOPPING
Bit of a wild one this but do a splunk stop, followed with;
ps x | grep splunk
At the start of each row is the PID of the app, type;
kill -9 PID
This will then kill the instance. I would be tempted to kill each splunk entry (the web one should start with python -O and then the rest of the name lists off into the Splunk directory.
This is a bit of a hack and a slash method however, once done try starting it up again.
If that fails it might be the lock file (If I remember this correctly) and it may not be getting cleared or it may have been created by a user of a higher level and splunk is now having a fit when trying to start.
Note: this assumes linux 🙂
Bit of a wild one this but do a splunk stop, followed with;
ps x | grep splunk
At the start of each row is the PID of the app, type;
kill -9 PID
This will then kill the instance. I would be tempted to kill each splunk entry (the web one should start with python -O and then the rest of the name lists off into the Splunk directory.
This is a bit of a hack and a slash method however, once done try starting it up again.
If that fails it might be the lock file (If I remember this correctly) and it may not be getting cleared or it may have been created by a user of a higher level and splunk is now having a fit when trying to start.
Note: this assumes linux 🙂
no probs 🙂
this did it - thanks!