Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ag-Splunk-n-Linux > Troubleshooting 101 > Flashcards

Troubleshooting 101 Flashcards

1
Q

What is SNOW?

A

a ticketing system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does ps -aux do?

A

lists all processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How to end a process?

A

kill -9 [PID]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How to check the processes that are taking the most resources on a system?

A

with a top command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What could we do if for some reason ./splunk restart command was not working?

A

kill -9 splunk process, and then try to run splunk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what is /proc/meminfo?

A

stores info about how much memory is available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what is /proc/cpuinfo?

A

stores information about cpu utilization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does fdisk -l do?

A

lists available drives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does rpm -qa do?

A

lists installed rpm packages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does netstat -tanpu do?

A

Finds which ports are open and listening for inbound data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is minimum hardware specification for Search Heads?

A
  • 16 physical cpu cores or 32 vcpu at 2ghz or greater speed core
  • 12 gb ram
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is minimum hardware requirement for indexers?

A
  • 12 physical cpu cores or 24 vcpu at 2ghz or greater speed core
  • 12 gb ram
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is MID-range hardware requirement for indexers?

A
  • 24physical cpu cores or 48 vcpu at 2ghz or greater speed core
  • 64 gb ram
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is high performance hardware requirement for indexers?

A
  • 48 physical CPU cores, or 96 vCPU or greater per core
  • 128 gb RAM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Where we can access Splunk internal logs?

A

We can find internal splunk logs in _internal index (so we woul run a search on SH GUI) or we can access the files directly through CLI : $SPLUNK_HOME/var/log/splunk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does tail -f do?

A

Prints last 10 lines of a file nad output appended data as the file grows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Name some of splunk .log files

A

audit.log

license_usage.log

metrics. log
splunkd. log

slunk_ui_access.log

splunk_web_access.log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does audit.log store?

A

Audits what users do on a system, gives information about users activity such as failed login, running a search, modyfing a setting and more

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does license_usage.log store?

A

It keeps track of how much license is being used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does metrics.log store?

A

Contains periodic snapshots of Splunk performance and system data, including information about CPU usage by internal processes and queue usage in Splunk’s data processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is throughput?

A

It is about how much data is flowing through splunk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does splunkd.log store?

A

It stores information on what is going in splunk. It is a troubleshooting file - look for “errors” and “warns” in it.

23
Q

What does splunk_ui_access.log store?

A

It stores gui response time

24
Q

What does splunk_web_access.log store?

A

It stores web server logs

25
Q

What is btool?

A

It shows you the settings in the given .conf files. Shows you possibles mistakes in configurations.

26
Q

How to display a sum of a given configuration file in a given splunk component?

A

./splunk btool [.conf file name] list

i.e:

./splunk btool inputs list

27
Q

How to display a sum of a given configuration file in a given splunk component and show filepaths to each line?

A

./splunk btool [file] list –debug

28
Q

How to check for typos in stanzas and settings names?

A

./splunk btool check

29
Q

How to prepere and send diag file?

A
  1. ./splunk diag
  2. Using SFTP transfer diag file (double check permissions and ownership) to your machine, and from it send it to Splunk support

or, if you have access to web use this command which will create diag file and send it

./splunk diag –upload

30
Q

How to troubleshoot forwarder?

A
  • Check if splunk is running (./splunk status)
  • Check deploymentclient.conf
  • check inputs.conf/outputs.conf
  • check splunkd.log to ensure that the forwarder is correctly connected to the indexers
31
Q

How to troubleshoot users not having accesds to their data?

A

a) check if the data is there
b) look at client’s role

Settings>Access Control >User Access > Users

c) Ensure that the following user’s role has access to the index

32
Q

lists all processes

A

What does ps -aux do?

33
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

kill -9 [PID]

A

How to end a process?

34
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

stores info about how much memory is available

A

what is /proc/meminfo?

35
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

stores information about cpu utilization

A

what is /proc/cpuinfo?

36
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

lists available drives

A

What does fdisk -l do?

37
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

lists installed rpm packages

A

What does rpm -qa do?

38
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

Finds which ports are open and listening for inbound data

A

What does netstat -tanpu do?

39
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

  • 16 physical cpu cores or 32 vcpu at 2ghz or greater speed core
  • 12 gb ram
A

What is minimum hardware specification for Search Heads?

40
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

  • 12 physical cpu cores or 24 vcpu at 2ghz or greater speed core
  • 12 gb ram
A

What is minimum hardware requirement for indexers?

41
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

  • 24physical cpu cores or 48 vcpu at 2ghz or greater speed core
  • 64 gb ram
A

What is MID-range hardware requirement for indexers?

42
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

  • 48 physical CPU cores, or 96 vCPU or greater per core
  • 128 gb RAM
A

What is high performance hardware requirement for indexers?

43
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

Prints last 10 lines of a file nad output appended data as the file grows

A

What does tail -f do?

44
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

Audits what users do on a system, gives information about users activity such as failed login, running a search, modyfing a setting and more

A

What does audit.log store?

45
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

It keeps track of how much license is being used

A

What does license_usage.log store?

46
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

Contains periodic snapshots of Splunk performance and system data, including information about CPU usage by internal processes and queue usage in Splunk’s data processing

A

What does metrics.log store?

47
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

It is about how much data is flowing through splunk

A

What is throughput?

48
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

It stores information on what is going in splunk. It is a troubleshooting file - look for “errors” and “warns” in it.

A

What does splunkd.log store?

49
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

It stores gui response time

A

What does splunk_ui_access.log store?

50
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

It stores web server logs

A

What does splunk_web_access.log store?

51
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

It shows you the settings in the given .conf files. Shows you possibles mistakes in configurations.

A

What is btool?

52
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

./splunk btool [.conf file name] list

i.e:

./splunk btool inputs list

A

How to display a sum of a given configuration file in a given splunk component?

53
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

./splunk btool [file] list –debug

A

How to display a sum of a given configuration file in a given splunk component and show filepaths to each line?

54
Q

This is the “reversed” card. It first displays you the answer and you have to guess the question part of it.

./splunk btool check

A

How to check for typos in stanzas and settings names?

ag-Splunk-n-Linux (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions