Troubleshooting 101 Flashcards
What is SNOW?
a ticketing system
What does ps -aux do?
lists all processes
How to end a process?
kill -9 [PID]
How to check the processes that are taking the most resources on a system?
with a top command
What could we do if for some reason ./splunk restart command was not working?
kill -9 splunk process, and then try to run splunk
what is /proc/meminfo?
stores info about how much memory is available
what is /proc/cpuinfo?
stores information about cpu utilization
What does fdisk -l do?
lists available drives
What does rpm -qa do?
lists installed rpm packages
What does netstat -tanpu do?
Finds which ports are open and listening for inbound data
What is minimum hardware specification for Search Heads?
- 16 physical cpu cores or 32 vcpu at 2ghz or greater speed core
- 12 gb ram
What is minimum hardware requirement for indexers?
- 12 physical cpu cores or 24 vcpu at 2ghz or greater speed core
- 12 gb ram
What is MID-range hardware requirement for indexers?
- 24physical cpu cores or 48 vcpu at 2ghz or greater speed core
- 64 gb ram
What is high performance hardware requirement for indexers?
- 48 physical CPU cores, or 96 vCPU or greater per core
- 128 gb RAM
Where we can access Splunk internal logs?
We can find internal splunk logs in _internal index (so we woul run a search on SH GUI) or we can access the files directly through CLI : $SPLUNK_HOME/var/log/splunk
What does tail -f do?
Prints last 10 lines of a file nad output appended data as the file grows
Name some of splunk .log files
audit.log
license_usage.log
metrics. log
splunkd. log
slunk_ui_access.log
splunk_web_access.log
What does audit.log store?
Audits what users do on a system, gives information about users activity such as failed login, running a search, modyfing a setting and more
What does license_usage.log store?
It keeps track of how much license is being used
What does metrics.log store?
Contains periodic snapshots of Splunk performance and system data, including information about CPU usage by internal processes and queue usage in Splunk’s data processing
What is throughput?
It is about how much data is flowing through splunk
What does splunkd.log store?
It stores information on what is going in splunk. It is a troubleshooting file - look for “errors” and “warns” in it.
What does splunk_ui_access.log store?
It stores gui response time
What does splunk_web_access.log store?
It stores web server logs
What is btool?
It shows you the settings in the given .conf files. Shows you possibles mistakes in configurations.
How to display a sum of a given configuration file in a given splunk component?
./splunk btool [.conf file name] list
i.e:
./splunk btool inputs list
How to display a sum of a given configuration file in a given splunk component and show filepaths to each line?
./splunk btool [file] list –debug
How to check for typos in stanzas and settings names?
./splunk btool check
How to prepere and send diag file?
- ./splunk diag
- Using SFTP transfer diag file (double check permissions and ownership) to your machine, and from it send it to Splunk support
or, if you have access to web use this command which will create diag file and send it
./splunk diag –upload
How to troubleshoot forwarder?
- Check if splunk is running (./splunk status)
- Check deploymentclient.conf
- check inputs.conf/outputs.conf
- check splunkd.log to ensure that the forwarder is correctly connected to the indexers
How to troubleshoot users not having accesds to their data?
a) check if the data is there
b) look at client’s role
Settings>Access Control >User Access > Users
c) Ensure that the following user’s role has access to the index
lists all processes
What does ps -aux do?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
kill -9 [PID]
How to end a process?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
stores info about how much memory is available
what is /proc/meminfo?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
stores information about cpu utilization
what is /proc/cpuinfo?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
lists available drives
What does fdisk -l do?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
lists installed rpm packages
What does rpm -qa do?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
Finds which ports are open and listening for inbound data
What does netstat -tanpu do?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
- 16 physical cpu cores or 32 vcpu at 2ghz or greater speed core
- 12 gb ram
What is minimum hardware specification for Search Heads?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
- 12 physical cpu cores or 24 vcpu at 2ghz or greater speed core
- 12 gb ram
What is minimum hardware requirement for indexers?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
- 24physical cpu cores or 48 vcpu at 2ghz or greater speed core
- 64 gb ram
What is MID-range hardware requirement for indexers?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
- 48 physical CPU cores, or 96 vCPU or greater per core
- 128 gb RAM
What is high performance hardware requirement for indexers?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
Prints last 10 lines of a file nad output appended data as the file grows
What does tail -f do?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
Audits what users do on a system, gives information about users activity such as failed login, running a search, modyfing a setting and more
What does audit.log store?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
It keeps track of how much license is being used
What does license_usage.log store?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
Contains periodic snapshots of Splunk performance and system data, including information about CPU usage by internal processes and queue usage in Splunk’s data processing
What does metrics.log store?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
It is about how much data is flowing through splunk
What is throughput?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
It stores information on what is going in splunk. It is a troubleshooting file - look for “errors” and “warns” in it.
What does splunkd.log store?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
It stores gui response time
What does splunk_ui_access.log store?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
It stores web server logs
What does splunk_web_access.log store?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
It shows you the settings in the given .conf files. Shows you possibles mistakes in configurations.
What is btool?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
./splunk btool [.conf file name] list
i.e:
./splunk btool inputs list
How to display a sum of a given configuration file in a given splunk component?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
./splunk btool [file] list –debug
How to display a sum of a given configuration file in a given splunk component and show filepaths to each line?
This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.
./splunk btool check
How to check for typos in stanzas and settings names?
