Running SplunkWeb in Legacy Mode by setting appServerPorts = 0
更新履歴
- 初版 2019/10/22
はじめに
- Splunkをインストールし，nginxをフロントエンドにしてい他のだけれど，メッセージ通知があったので，それを改善する．
メッセージを確認
- リンクにアクセスすると，次のページに．
https://docs.splunk.com/Documentation/Splunk/7.3.1/ReleaseNotes/Deprecatedfeatures
- ここには次のように記載．
Running SplunkWeb in Legacy Mode by setting appServerPorts = 0 in web.conf has been deprecated. This was a temporary workaround for issues that are now resolved. Normal mode provides performance and configuration benefits.
- web.confのappServerPortsを0に設定する事は最新のバージョンでは廃止されていて，元々一時的なものだったようだ．
- という事で，修復してみる．
web.confの設定を変更
- まずは変更するweb.confを確認．
$ cd /Applications/Splunk/etc/system/default🆑
$ ls -la web.conf🆑
-r--r--r-- 1 nobuaki wheel 53448 10 22 16:41 web.conf🈁
$- web.confの中身を確認．
# list of ports to start python application servers on (although usually
# one port is enough) Set to 0 to instead run the application server
# directly as the web front end on 'httpport', separate from splunkd.
#appServerPorts = 8065
appServerPorts = 0- nginxをリバースプロキシにする際にappServerPorts=0を設定しているが，これを元に戻す．
# list of ports to start python application servers on (although usually
# one port is enough) Set to 0 to instead run the application server
# directly as the web front end on 'httpport', separate from splunkd.
appServerPorts = 8065
#appServerPorts = 0- 元に戻したら，Splunkの再起動．
$ /Applications/Splunk/bin/splunk stop🆑
Stopping splunkweb...
Stopping splunkd...
Shutting down. Please wait, as this may take a few minutes.
Stopping splunk helpers...
Done.
$- 停止できたら，起動する．
$ /Applications/Splunk/bin/splunk start🆑
Splunk> Finding your faults, just like mom.
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open🈁
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Validated: _audit _internal _introspection _telemetry _thefishbucket history ipaccess_access ipaccess_error juno_syslog main
ujpadmin_access ujpadmin_error summary ujp_access ujp_error ujp_mail
ujp_mailaccess
Done
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from '/Applications/Splunk/splunk-7.3.1.1-7651b7244cf2-darwin-64-manifest'
File '/Applications/Splunk/etc/system/default/web.conf' changed.
Problems were found, please review your files and
move customizations to local
All preliminary checks passed.
Starting splunk server daemon (splunkd)...
Done
Waiting for web server at http://127.0.0.1:8000 to be available.... Done
If you get stuck, we're here to help.
Look for answers here: http://docs.splunk.com
The Splunk web interface is at http://gaia.local:8000
$- appServerもポート8065で稼働したことが確認できた．
Splunkにログインしてメッセージの確認
- 再起動後，ログインしてみる．
- エラーメッセージがなくなっていた．（新バージョンが出ているらしいが・・・）
