Splunk® Enterprise

Admin Manual

Download manual as PDF

Download topic as PDF

Run Splunk Enterprise as a systemd service

Splunk Enterprise 7.2.2 and later adds broad support for systemd on Linux with an updated enable boot-start command that lets you automatically configure systemd to manage splunkd as a service.

What is systemd?

systemd is a system startup and service manager that is widely deployed as the default init system on most major Linux distributions. You can configure systemd to manage processes, such as splunkd, as services, and allocate system resources to those processes under cgroups.

systemd advantages

systemd offers the following general advantages:

  • Enhanced parallel processing.
  • Simplified configuration with standardized unit text files. No scripts required.
  • Improved mechanism for expressing dependencies. For example, you can specify in the unit file that the network must be up before startup of the splunkd service occurs.

systemd offers these additional specific advantages for Splunk deployments:

  • Start splunkd at boot.
  • Monitor and manage splunkd service during runtime.
  • Provides tools to debug and troubleshoot boot-time and service activities.
  • Allows more control over plug-in monitoring tools that track the status of Splunk instances.
  • Simplifies the set up of cgroups required for workload management in Splunk Enterprise. See Set up Linux for workload management.

Configure systemd to manage splunkd

There are two ways to configure systemd to manage splunkd as a service:

System requirements

  • To run splunkd as a systemd service requires one of the following supported Linux distributions:
    • RHEL 6 and 7
    • CentOS 6 and 7
    • Ubuntu 16.04 LTS and later
    • Suse 12
  • To configure systemd using enable boot-start requires Splunk Enterprise version 7.2.2 or later.
  • To enable workload management in Splunk Enterprise under systemd requires systemd version 219 or higher. For more information, see Linux operating system requirements in the Workload Management manual.

Permissions requirements

The enable boot-start command and systemd have the following permissions requirements:

  • Non-root users must have super user permissions to configure systemd using enable boot-start.
  • Non-root users must have super user permissions to run start, stop, restart under systemd.

For instructions on how to create a new user with super user permissions, see your Linux documentation. The specific steps can vary depending on the Linux distribution.

You must use sudo to run splunk start|stop|restart commands. If you do not use sudo, you must authenticate. For example:

==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ===
Authentication is required to manage system services or units.
Multiple identities can be used for authentication:
 1.  <username_1>
 2.  <username_2>
Choose identity to authenticate as (1-2): 2
Password: 
==== AUTHENTICATION COMPLETE ===

Unit file naming considerations

The enable boot-start command creates a systemd unit file named Splunkd.service. The unit file name is based on the SPLUNK_SERVER_NAME in splunk-launch.conf, which is by default Splunkd.

If for any reason SPLUNK_SERVER_NAME is absent from splunk-launch.conf, enable boot-start creates a unit file named splunkd.service (lower case "splunkd") and sets SPLUNK_SERVER_NAME=splunkd in the splunk-launch.conf file.

You can specify a different name for the unit file when you run enable boot-start. See Specify the unit file name.

Configure systemd using enable boot-start

You can configure systemd to manage splunkd as a service using the enable boot-start command, as follows:

  1. Log into the machine on which you want to configure systemd to manage splunkd as a service.
  2. Stop splunkd.
    $SPLUNK_HOME/bin/splunk stop
    
  3. If you previously enabled Splunk Enterprise to start at boot using the enable boot-start command, run disable boot-start to remove the splunk init script located in /etc/init.d and its symbolic links.
    [sudo] $SPLUNK_HOME/bin/splunk disable boot-start
    

    For instructions on how to reinstall the splunk init script, see Install splunk init script.

  4. Run the enable boot-start command, specifying the -systemd-managed and -user options, as follows:
    [sudo] $SPLUNK_HOME/bin/splunk enable boot-start -systemd-managed 1 -user <username>
    

    This installs the following systemd unit file, named Splunkd.service by default, in /etc/systemd/system. To specify a different unit file name, use the -systemd-unit-file-name option. See Specify the splunkd unit file name.

    #This unit file replaces the traditional start-up script for systemd
    #configurations, and is used when enabling boot-start for Splunk on
    #systemd-based Linux distributions.
    
    [Unit]
    Description=Systemd service file for Splunk, generated by 'splunk enable boot-start'
    After=network.target
    
    [Service]
    Type=simple
    Restart=always
    ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd
    LimitNOFILE=65536
    SuccessExitStatus=51 52
    RestartPreventExitStatus=51
    RestartForceExitStatus=52
    User=<username>
    Delegate=true
    MemoryLimit=100G
    CPUShares=1024
    PermissionsStartOnly=true
    ExecStartPost=/bin/bash -c "chown -R <userid>:<groupid> /sys/fs/cgroup/cpu/system.slice/%n"
    ExecStartPost=/bin/bash -c "chown -R <userid>:<groupid> /sys/fs/cgroup/memory/system.slice/%n"
    
    [Install]
    WantedBy=multi-user.target
    

    If you run enable boot-start as root without specifying -user, the default unit file appears as follows:

    [Unit]
    Description=Systemd service file for Splunk, generated by 'splunk enable boot-start'
    After=network.target
    
    [Service]
    Type=simple
    Restart=always
    ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd
    LimitNOFILE=65536
    SuccessExitStatus=51 52
    RestartPreventExitStatus=51
    RestartForceExitStatus=52
    Delegate=true
    MemoryLimit=100G
    CPUShares=1024
    
    [Install]
    WantedBy=multi-user.target
    
  5. After creating the unit file with enable boot-start, to ensure graceful shutdown, add these additional properties to the [Service] stanza of the unit file:
    KillMode=mixed
    KillSignal=SIGINT
    TimeoutStopSec=10min
    

    The following unit file properties are required. Do not change these values without appropriate guidance.
    Type=simple
    Restart=always
    ExecStart=$SPLUNK_HOME/bin/splunk _internal_launch_under_systemd
    Delegate=true This property is required for workload management. See Configure workload management.

    Do not use the following properties. These properties can cause splunkd to fail on restart.
    RemainAfterExit=yes
    ExecStop

    For more information, see Systemd unit file properties.

  6. If you are running systemd on Ubuntu, check if the default hierarchy is "hybrid". For example:
    systemctl --version
    systemd 237
    +PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2 default-hierarchy=hybrid
    

    If default-hierachy=hybrid the chown path in the unit file might be incorrect. In this case, you must determine the correct path and manually change it in the unit file. For example:

    ExecStartPost=/bin/bash -c "chown -R 2021:2021 /sys/fs/cgroup/cpu/system.slice/%n"
    ExecStartPost=/bin/bash -c "chown -R 2021:2021 /sys/fs/cgroup/memory/system.slice/%n"
    
  7. Start splunkd.
    [sudo] $SPLUNK_HOME/bin/splunk start
    

    This starts splunkd as a systemd service.

    Under systemd, splunk start|stop|restart commands are mapped to systemctl start|stop|restart commands.

  8. Verify that splunkd is running as a systemd service. For example:
    $SPLUNK_HOME/bin/splunk status
    splunkd is running (PID: 24772).
    splunk helpers are running (PIDs: 24843 24857 24984 25032).
    

    Alternatively, you can use systemctl status <unit_file_name> to check if the splunkd process is running. However, you might experience a brief time lag during which systemctl status shows "active" and splunk status shows "splunkd is not running".

    Configuring systemd to manage splunkdas a service creates CPU and Memory cgroups in these locations:
    CPU: /sys/fs/cgroup/cpu/system.slice/Splunkd.service
    Memory: /sys/fs/cgroup/memory/system.slice/Splunkd.service

  9. For distributed deployments, repeat steps 1-8 on all search heads and indexers.

Additional options for enable boot-start

The enable boot-start command supports these additional options:

Install splunk init script

In version 7.2.2 and later, the enable boot-start command adds a -systemd-managed 0|1 option that controls whether to install the splunk init script in /etc/init.d or the Splunkd.service unit file in /etc/systemd/system.

To install the splunk init script, specify -systemd-managed 0:

$SPLUNK_HOME/bin/splunk enable boot-start -systemd-managed 0 -user <username>
Init script installed at /etc/init.d/splunk.
Init script is configured to run at boot.

See Configure Splunk Enterprise to start at boot time.

In version 7.2.2 through 7.2.x, if you do not specify the -systemd-managed option, the enable boot-start command defaults to -systemd-managed 1 and installs the Splunkd.service unit file. In version 7.3.0 and later, the enable boot-start command defaults to -systemd-managed 0 and installs the splunkinit file.

Specify the unit file name

The default splunkd unit file name is Splunkd.service. You can specify a different name for the unit file and update the SPLUNK_SERVER_NAME value in splunk-launch.conf using the -systemd-unit-file-name option. For example, to create a unit file with the name "splunk.server":

$SPLUNK_HOME/bin/splunk enable boot-start -systemd-unit-file-name splunk
Overwriting present value (Splunkd) of 'SPLUNK_SERVER_NAME' in /opt/splunk/etc/splunk-launch.conf
Init script installed at /etc/systemd/system.
Init script is configured to run at boot.

For more information, see Unit file naming considerations. </div>

Configure systemd on a clean install

To configure systemd on a clean installation of Splunk Enterprise:

  1. Expand the install package in an appropriate directory. For example:
    tar xvfz splunk_package_name.tgz -C /opt
    
  2. Run enable boot-start to install the Splunkd.service unit file:
    sudo $SPLUNK_HOME/bin/splunk enable boot-start -systemd-managed 1 -user <username>
    
  3. Start splunkd.
    sudo $SPLUNK_HOME/bin/splunk start
    
  4. Verify that splunkd is running as a systemd service.
    $SPLUNK_HOME/bin/splunk status
    

Manage clusters under systemd

When managing an indexer cluster under systemd:

  • You must use the sudo command to start, stop, and restart the cluster master or individual peer nodes using splunk start|stop|restart commands.
  • You do not need sudo to perform a rolling restart using the splunk rolling-restart cluster-peers command, or to take a peer offline using the splunk offline command.

When managing a search head cluster under systemd:

  • You must use the sudo command to start, stop, and restart cluster members using splunk start|stop|restart commands.
  • You do not need sudo to perform a rolling restart using the splunk rolling-restart shcluster-members command, or to remove a cluster member using the splunk remove shcluster-members command.

Configure systemd manually

For instructions on how to manually configure systemd to run splunkd as a service, see Configure systemd manually in the Workload management manual.

PREVIOUS
Configure Splunk Enterprise to start at boot time
  NEXT
Install your license

This documentation applies to the following versions of Splunk® Enterprise: 7.3.0, 7.3.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters