- Splunk Answers
- :
- Splunk Platform Products
- :
- Splunk Cloud Platform
- :
- Re: Spluk service on linux stopping frequently.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Spluk service on linux stopping frequently.
Hi all,
Two of our splunk search heads out of 20 are stopping very frequently. We di check splunkd.log after taking diag on the same.
Could see few errors and a fatal entry after which no entries in splunkd.log.
06-12-2018 17:06:42.339 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_nix/bin/lastlog.sh" /bin/sh: /opt/splunk/etc/apps/Splunk_TA_nix/bin/lastlog.sh: Permission denied
06-12-2018 17:06:46.839 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_nix/bin/df.sh" /bin/sh: /opt/splunk/etc/apps/Splunk_TA_nix/bin/df.sh: Permission denied
06-12-2018 17:07:03.974 -0500 FATAL ProcessRunner - Unexpected EOF from process runner child!
Team, Need your expertise for resolving the same.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FATAL ProcessRunner - Unexpected EOF from process runner child! usually means that you are running out of resources on the server ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Lacastillo,
yes the permissions across all search heads are same. It's a clustered environment.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do your permissions for Splunk and all of its folders and subfolders (including all the apps) on the two servers in question match the rest of the currently working servers?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes all search heads have same user credentials.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would raise a support case and submit the diag along with any information you have that might allow support to reproduce/troubleshoot the error. This is definitely the type of thing they're there for. I wish I could be of more help.
Before submitting your case, be sure that you are listed as a contact on the company support entitlement. If you are not listed, have the person who is the designated support contact at your company submit the case.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Pradeep,
no such crash logs found.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
do you see any crash*.log inside var/log/splunk/ ?
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
