Unfortunately I don’t know much more than that as to what is actually causing it to happen. Yup each time it crashed it was splunkd that caused it. I ended up installing the crash utilities on the host and started going through the vmcore files. So I restarted the machine and started splunk back up and everything was working again.Ī few days past and I went to check on it again, and once again it was dead. I was dumbfounded as I hadn’t seen an actual kernel panic like that in a while. It appeared that the linux host had crashed. The next day when I returned home I tried to log in to my Splunk instance to see how it was doing, to my surprise I couldn’t even log in to it. An hour or so later it couldn’t fix some of them, so it was getting late and I just went to bed. So off to the fsck commmand to try to fix them. I am not sure if it happened during the transit or what. If it was a search for like the last 15 minutes it worked, but anything over that was dead because one of the hot buckets was corrupted. So far everything was good, until I tried to do a search. I then removed the bin and lib directories (I use the tar installs and that is they only place machine specific binaries exist.) With that done, I untarred the Linux Splunk 7.0 over top my current directory and started it up. With that I spun up a new CentOS 7 VM on my home server, and copied over all my Splunk data from the Solaris one to the Linux one. So now that Solaris is no longer supported, I needed to switch my home system from OpenIndiana (aka OpenSolaris) over to Linux.
Basically used for development and home use, not for enterprise use.) (MacOSX is supported, but only for the free and trial editions. However over the years that list has been pared back to now just Linux and Windows. If you wanted Solaris, FreeBSD, AIX, HP-UX, MacOSX, Windows or Linux you were golden. This is where the fun began.įirst when I started using Splunk years ago, it supported a myriad of operating systems for the servers. So like all “fanboys” of anything I decided to update my home server on Thursday night after the conference was over. There were a few new features in it that were amazing, such as the new metrics index type which was blazingly fast. Conf 2017 conference, which I was an FTR at. So on with the post, and it must be a good one right? Anyways, Splunk released version 7.0 of their Splunk Enterprise product last week during their. So I will preface this post by saying I love Splunk, it is the best log aggregation application out there.
0 kommentar(er)
