Splunk Crashing Issues
Issue:
Splunk software is crashing too often
File name: $SPLUNK_HOME/splunk/var/log/splunk/crash.log
[build 6818ac46f2ec] 2023-12-11 15:43:29
Received fatal signal 6 (Aborted) on PID 20332.
Cause: Signal sent by PID 20332 running under UID 1002.
Cause: Signal sent by PID 20332 running under UID 1002.
Crashing thread: WebuiStartup
Root cause:
The crash happens if appServerProcessLogStderr is enabled in web.conf
Note: With appServerProcessLogStderr enabled, the issue/same crash call stack by adding random text in proxy.py so it does not load.
The crash happens if appServerProcessLogStderr is enabled in web.conf
Note: With appServerProcessLogStderr enabled, the issue/same crash call stack by adding random text in proxy.py so it does not load.
File name: /opt/splunk/etc/system/local/web.conf
[settings]
appServerProcessLogStderr = true
Solution:
Disable the appServerProcessLogStderr property in web.conf
Disable the appServerProcessLogStderr property in web.conf
File name: /opt/splunk/etc/system/local/web.conf
[settings]
appServerProcessLogStderr = false