About haruban36

haruban36 · ‎04-05-2023

Splunk Enterprise 8.1.3 I installed splunkforwarder-8.1.3-63079c59e632-AIX-powerpc. AIX version is 7.1 A problem occurred that the connection to the AIX server where UF was installed was lost. So I restarted AIX UF, but the connection was lost again. the following error log is displayed right before disconnection Check the logs below for further confirmation. ===================================================================== 03-29-2023 05:00:28.927 +0900 WARN X509Verify - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used; see: <http://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates> 03-29-2023 05:00:28.938 +0900 INFO ArchiveProcessor - Handling file=/LOG/tux/CLOG.032723.Z 03-29-2023 05:00:28.942 +0900 INFO ArchiveProcessor - reading path=/LOG/tux/CLOG.032723.Z (seek=0 len=113564693) 03-29-2023 05:00:29.027 +0900 INFO UiHttpListener - Web UI disabled in web.conf [settings]; not starting 03-29-2023 05:00:29.097 +0900 INFO WatchedFile - Will begin reading at offset=13491182 for file='/LOG/tux/CLOG.032923'. 03-29-2023 05:00:29.250 +0900 ERROR ProcessRunner - child's last words: cannot find portable_pid_t 9372426 in _pidToUniqMap 03-29-2023 05:00:29.252 +0900 FATAL ProcessRunner - Unexpected EOF from process runner child! 03-29-2023 05:00:29.299 +0900 ERROR ProcessRunner - helper process seems to have died (child exited with code 255)! 03-29-2023 05:00:29.299 +0900 ERROR ExecProcessor - Exception attempting to setup event loop 03-29-2023 05:00:29.299 +0900 ERROR ExecProcessor - child's last words: cannot find portable_pid_t 9372426 in _pidToUniqMap

haruban36 · ‎04-05-2023

Splunk Enterprise 8.1.3 I installed splunkforwarder-8.1.3-63079c59e632-AIX-powerpc. There was a problem with the universalforwarder connection being disconnected, so I restarted it. However, even after restarting, the connection was lost after a certain period of time. I am attaching the last 15 lines of splunkd log before disconnection. Check the logs below for further confirmation. =============================================================================== 03-29-2023 05:00:28.918 +0900 INFO WatchedFile - Will begin reading at offset=338882 for file='/IBTRANS/SPQ/var/log/event_log'. 03-29-2023 05:00:28.919 +0900 INFO TcpOutputProc - _isHttpOutConfigured=NOT_CONFIGURED 03-29-2023 05:00:28.922 +0900 INFO TcpOutputProc - Connected to idx=150.1.13.90:9997, pset=0, reuse=0. 03-29-2023 05:00:28.927 +0900 INFO loader - Limiting REST HTTP server to 400000 sockets 03-29-2023 05:00:28.927 +0900 INFO loader - Limiting REST HTTP server to 10922 threads 03-29-2023 05:00:28.927 +0900 WARN X509Verify - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used; see: <http://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates> 03-29-2023 05:00:28.938 +0900 INFO ArchiveProcessor - Handling file=/LOG/tux/CLOG.032723.Z 03-29-2023 05:00:28.942 +0900 INFO ArchiveProcessor - reading path=/LOG/tux/CLOG.032723.Z (seek=0 len=113564693) 03-29-2023 05:00:29.027 +0900 INFO UiHttpListener - Web UI disabled in web.conf [settings]; not starting 03-29-2023 05:00:29.097 +0900 INFO WatchedFile - Will begin reading at offset=13491182 for file='/LOG/tux/CLOG.032923'. 03-29-2023 05:00:29.250 +0900 ERROR ProcessRunner - child's last words: cannot find portable_pid_t 9372426 in _pidToUniqMap 03-29-2023 05:00:29.252 +0900 FATAL ProcessRunner - Unexpected EOF from process runner child! 03-29-2023 05:00:29.299 +0900 ERROR ProcessRunner - helper process seems to have died (child exited with code 255)! 03-29-2023 05:00:29.299 +0900 ERROR ExecProcessor - Exception attempting to setup event loop 03-29-2023 05:00:29.299 +0900 ERROR ExecProcessor - child's last words: cannot find portable_pid_t 9372426 in _pidToUniqMap

haruban36 · ‎04-05-2023

Splunk Enterprise 8.1.3 I installed splunkforwarder-8.1.3-63079c59e632-AIX-powerpc. There was a problem with the universalforwarder connection being disconnected, so I restarted it. However, even after restarting, the connection was lost after a certain period of time. I am attaching the last 10 lines of splunkd log before disconnection. Check the logs below for further confirmation. =============================================================================== 03-29-2023 05:00:28.927 +0900 WARN X509Verify - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used; see: <http://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates> 03-29-2023 05:00:28.938 +0900 INFO ArchiveProcessor - Handling file=/LOG/tux/CLOG.032723.Z 03-29-2023 05:00:28.942 +0900 INFO ArchiveProcessor - reading path=/LOG/tux/CLOG.032723.Z (seek=0 len=113564693) 03-29-2023 05:00:29.027 +0900 INFO UiHttpListener - Web UI disabled in web.conf [settings]; not starting 03-29-2023 05:00:29.097 +0900 INFO WatchedFile - Will begin reading at offset=13491182 for file='/LOG/tux/CLOG.032923'. 03-29-2023 05:00:29.250 +0900 ERROR ProcessRunner - child's last words: cannot find portable_pid_t 9372426 in _pidToUniqMap 03-29-2023 05:00:29.252 +0900 FATAL ProcessRunner - Unexpected EOF from process runner child! 03-29-2023 05:00:29.299 +0900 ERROR ProcessRunner - helper process seems to have died (child exited with code 255)! 03-29-2023 05:00:29.299 +0900 ERROR ExecProcessor - Exception attempting to setup event loop 03-29-2023 05:00:29.299 +0900 ERROR ExecProcessor - child's last words: cannot find portable_pid_t 9372426 in _pidToUniqMap

haruban36 · ‎04-05-2023

Hi @gcusello! Aix version is 7.1 excuse me, I have one more question. server where the message originated There was also a problem with UF disconnection. So I restarted it, but the problem occurred again. Should I open a case on this issue as well? the following error log is displayed. Check the logs below for further confirmation. thank you very much for your response! ======================================================================== 03-29-2023 05:00:29.097 +0900 INFO WatchedFile - Will begin reading at offset=13491182 for file='/LOG/tux/CLOG.032923'. 03-29-2023 05:00:29.250 +0900 ERROR ProcessRunner - child's last words: cannot find portable_pid_t 9372426 in _pidToUniqMap 03-29-2023 05:00:29.252 +0900 FATAL ProcessRunner - Unexpected EOF from process runner child! 03-29-2023 05:00:29.299 +0900 ERROR ProcessRunner - helper process seems to have died (child exited with code 255)! 03-29-2023 05:00:29.299 +0900 ERROR ExecProcessor - Exception attempting to setup event loop 03-29-2023 05:00:29.299 +0900 ERROR ExecProcessor - child's last words: cannot find portable_pid_t 9372426 in _pidToUniqMap

haruban36 · ‎04-04-2023

Splunk Enterprise 8.1.3 I installed splunkforwarder-8.1.3-63079c59e632-AIX-powerpc. The error message comes from AIX os. When entering the "errpt" command, the following error message is displayed. Check the messages below for further confirmation. ===================================================================== LABEL: SRC_TRYX IDENTIFIER: 1BA7DF4E Date/Time: Wed Apr 5 05:00:32 KORST 2023 Sequence Number: 3589 Machine Id: 00CEC3474C00 Node Id: mgl888 Class: S Type: PERM WPAR: Global Resource Name: SRC Description SOFTWARE PROGRAM ERROR Probable Causes APPLICATION PROGRAM Failure Causes SOFTWARE PROGRAM Recommended Actions DETERMINE WHY SUBSYSTEM CANNOT RESTART Detail Data SYMPTOM CODE 2048 SOFTWARE ERROR CODE -9020 ERROR CODE 0 DETECTING MODULE 'srchevn.c'@line:'369' FAILING MODULE splunkd

haruban36 · ‎05-31-2022

Thank you for your answer. Is there any manual or documentation related to your answer?

haruban36 · ‎05-31-2022

Thank you for your answer. I used the Job Inspector to measure the performances.

haruban36 · ‎05-30-2022

version : splunk enterprise 8.1.3 I have a datasource with a field that is either an ip address. The following ip addresses are examples. If i do a search for a ip the response time is quite good. earliest=05/30/2022:00:00:00 earliest=05/30/2022:04:00:00 index=firewall src_ip=1.1.1.1 But, If i do a search for a ip the response time is slow. earliest=05/30/2022:00:00:00 earliest=05/30/2022:04:00:00 index=firewall src_ip=2.2.2.2 Is there a reason for the difference in search speed depending on the IP?

Posts	9
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎05-30-2022

Online Status	Offline
Date Last Visited	‎04-17-2023 09:45 PM

How to resolve universalforwarder 8.1.3 aix 7.1 di...

Why is there universalforwarder 8.1.3 aix disconne...

How to resolve universalforwarder 8.1.3 aix discon...

How to resolve universalforwarder 8.1.3 aix 7.1, 7...

Why do different ip addresses have different searc...