I am trying to install Splunk ES v 5.3.1 on Red Hat Enterprise Linux Server release 7.6.& Splunk Enterprise 7.2.5 We have one search head, one indexer, two HF and some other UF.
All indexes are hosted in the indexer. I am trying to install the ES on the SH, but the
configuration process ends with an error message in the "Conducting post-install actions"
phase. The search.log shows the following:
09-19-2019 10:18:34.798 INFO ChunkedExternProcessor - stderr: STAGE STARTING: "postinstall"
09-19-2019 10:18:37.944 INFO ChunkedExternProcessor - stderr: Skipping action for the app_permissions_manager://enforce_es_permissions modular input (may already be enabled)
09-19-2019 10:18:37.944 INFO ChunkedExternProcessor - stderr: Skipping action for the configuration_check://confcheck_es_identity_correlation modular input (may already be enabled)
09-19-2019 10:18:38.069 ERROR ChunkedExternProcessor - stderr: Error enabling the dm_accel_settings://Application_State modular input:
09-19-2019 10:18:38.069 ERROR ChunkedExternProcessor - stderr:
09-19-2019 10:18:38.069 ERROR ChunkedExternProcessor - stderr:
09-19-2019 10:18:38.069 ERROR ChunkedExternProcessor - stderr: This handler does not support object enabling
09-19-2019 10:18:38.069 ERROR ChunkedExternProcessor - stderr:
09-19-2019 10:18:38.069 ERROR ChunkedExternProcessor - stderr:
09-19-2019 10:18:38.070 ERROR ChunkedExternProcessor - stderr: Error enabling the dm_accel_settings://Application_State modular input
09-19-2019 10:18:38.073 ERROR ChunkedExternProcessor - stderr: ('Error enabling the %s modular input: %s', u'dm_accel_settings://Application_State', '\n\n \n This handler does not support object enabling\n \n\n')
09-19-2019 10:18:38.073 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last):
09-19-2019 10:18:38.073 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/install/deploy_manager_inputs.py", line 52, in deployManagerInputs
09-19-2019 10:18:38.073 ERROR ChunkedExternProcessor - stderr: raise Exception('Error enabling the %s modular input: %s', name, c)
09-19-2019 10:18:38.073 ERROR ChunkedExternProcessor - stderr: Exception: ('Error enabling the %s modular input: %s', u'dm_accel_settings://Application_State', '\n\n \n This handler does not support object enabling\n \n\n')
09-19-2019 10:18:38.075 ERROR ChunkedExternProcessor - stderr: Error retrieving manager inputs to deploy
09-19-2019 10:18:38.075 ERROR ChunkedExternProcessor - stderr: ('Error enabling the %s modular input', u'dm_accel_settings://Application_State')
09-19-2019 10:18:38.075 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last):
09-19-2019 10:18:38.075 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/install/deploy_manager_inputs.py", line 57, in deployManagerInputs
09-19-2019 10:18:38.075 ERROR ChunkedExternProcessor - stderr: raise Exception('Error enabling the %s modular input', name)
09-19-2019 10:18:38.075 ERROR ChunkedExternProcessor - stderr: Exception: ('Error enabling the %s modular input', u'dm_accel_settings://Application_State')
09-19-2019 10:18:38.084 ERROR ChunkedExternProcessor - stderr:
09-19-2019 10:18:38.084 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last):
09-19-2019 10:18:38.084 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/essinstall.py", line 171, in do_install
09-19-2019 10:18:38.084 ERROR ChunkedExternProcessor - stderr: output = fn(session_key, True)
09-19-2019 10:18:38.084 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/install/essinstaller2.py", line 54, in wrapper
09-19-2019 10:18:38.084 ERROR ChunkedExternProcessor - stderr: r = f(self, *args, **kwargs)
09-19-2019 10:18:38.084 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/install/essinstaller2.py", line 532, in stage_postinstall
09-19-2019 10:18:38.084 ERROR ChunkedExternProcessor - stderr: self._postinstall(session_key)
09-19-2019 10:18:38.084 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/install/essinstaller2.py", line 305, in _postinstall
09-19-2019 10:18:38.084 ERROR ChunkedExternProcessor - stderr: raise InstallException(str(e))
09-19-2019 10:18:38.084 ERROR ChunkedExternProcessor - stderr: InstallException: Error retrieving manager inputs to deploy
09-19-2019 10:18:38.084 ERROR ChunkedExternProcessor - stderr: postinstall failed.
09-19-2019 10:18:38.174 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PREVIEW
09-19-2019 10:18:38.389 INFO ReducePhaseExecutor - Ending phase_1
09-19-2019 10:18:38.389 INFO UserManager - Unwound user context: admin -> NULL
09-19-2019 10:18:38.391 INFO DispatchStorageManager - Remote storage disabled for search artifacts.
09-19-2019 10:18:38.391 INFO DispatchManager - DispatchManager::dispatchHasFinished(id='admin__admin__SplunkEnterpriseSecuritySuite__RMD5f59f452b9fca28e2_1568905910.67201', username='admin')
09-19-2019 10:18:38.411 INFO UserManager - Unwound user context: admin -> NULL
09-19-2019 10:18:38.477 INFO UserManager - Unwound user context: admin -> NULL
09-19-2019 10:18:38.483 INFO PipelineComponent - Process delayed by 406.802 seconds, perhaps system was suspended?
Could someone help me? Does anyone have any ideas?
P.S. previously I installed ES without any problem but it was in a single server environment.
↧