UF Crashes on Container Restart (9.2 and 9.1)
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- ansible, docker
- Domain
- devops, infrastructure
Research direction
No source files or tests are named. Reproduce a restart with the 9.2.1 and 9.1.4 container images, then inspect the splunk_universal_forwarder : Setup global HEC task and the reported 404 response. Done means the container restarts successfully without the failed HEC setup, while 9.0.9 remains unaffected.
Written by the indexing model from the issue text.
Description
When running containers on 9.2.1 (78803f08aabb) or 9.1.4 (a414fc70250e), if the container is restarted it fails to start with the following error:
TASK [splunk_universal_forwarder : Setup global HEC] ***************************
fatal: [localhost]: FAILED! => {
"changed": false
}
MSG:
POST/services/data/inputs/http/httpadmin********8089{'disabled': '0', 'enableSSL': '1', 'port': '8088', 'serverCert': '', 'sslPassword': ''}NoneNoneNone;;; AND excep_str: No Exception, failed with status code 404: {"text":"The requested URL was not found on this server.","code":404}
PLAY RECAP *********************************************************************
localhost : ok=67 changed=3 unreachable=0 failed=1 skipped=69 rescued=0 ignored=0
Thursday 18 April 2024 14:49:02 +0000 (0:00:00.588) 0:00:17.478 ********
===============================================================================
splunk_common : Start Splunk via CLI ------------------------------------ 1.59s
Gathering Facts --------------------------------------------------------- 0.95s
splunk_universal_forwarder : Setup global HEC --------------------------- 0.59s
splunk_common : Cleanup Splunk runtime files ---------------------------- 0.51s
splunk_common : Update Splunk directory owner --------------------------- 0.48s
splunk_common : Update /opt/splunk/etc ---------------------------------- 0.43s
splunk_common : Check for scloud ---------------------------------------- 0.41s
splunk_common : Set mgmt port ------------------------------------------- 0.40s
splunk_common : Find manifests ------------------------------------------ 0.38s
splunk_common : Check if UDS file exists -------------------------------- 0.32s
splunk_common : Configure to set Mgmt Mode as auto (Allows UDS) --------- 0.30s
splunk_common : Remove user-seed.conf ----------------------------------- 0.30s
splunk_common : Reset root CA ------------------------------------------- 0.29s
splunk_common : Get Splunk status --------------------------------------- 0.29s
splunk_common : Disable indexing on the current node -------------------- 0.29s
splunk_common : Ensure license path ------------------------------------- 0.29s
splunk_common : Get Splunk status --------------------------------------- 0.29s
splunk_common : Create .ui_login ---------------------------------------- 0.29s
splunk_common : Check if /sbin/updateetc.sh exists ---------------------- 0.29s
splunk_common : Enable splunktcp input ---------------------------------- 0.29s
9.0.9 (6315942c563f) appears unaffected.
- Dominant language
- Python
- Stars
- 549
- Forks
- 278
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 2
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from splunk/docker-splunk
-
Difficulty 2/5 Half a day Newbie friendliness 78/100
splunk/docker-splunk#730 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 58/100
splunk/docker-splunk#737 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
splunk/docker-splunk#732 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
splunk/docker-splunk#731 · 1 reaction ·
-
Difficulty 3/5 1-2 days Newbie friendliness 38/100
splunk/docker-splunk#724 ·
All issues in splunk/docker-splunk
Similar issues
-
json_params_matcher fails on falsy top-level JSON primitives (0, False, "")Possibly taken @mayureshsonawane17 claimed this today. OpenWaiting for: Product Owner
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 5 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
bojieli/ai-agent-book#1169 ·
Maintainers usually reply within 1 day
-
priority:low ready-for-dev
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OpenHands/extensions#738 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
micronaut-projects/micronaut-core#13677 ·
Maintainers usually reply within 1 day