Splunk forwarder not working

1. Logs are not splunk despite splunk showing as running:

2. Looking at the PID 13223, there is nothing specific to splunk running at this PID.

3. For some reasons, splunk PID remained hanged, so manually remove pid file from under "/opt/splunkforwarder/var/run/splunk" and start splunk.

4. This time everything fine and log files are splunked.
 

Solve java.net.BindException: Address already in use error messages

Ssh into the instance and check the port that is causing issues:

netstat -pan | grep ":4503 "

You should get exact pid of the process and status:

In this case the program is still busy in CLOSE_WAIT.
CLOSE_WAIT means your program is still running, and has not closed the socket.

You can get the java pid number and kill the program to clear the socket.

Linux RedHat 6.5 - Add Welcome Message when SSH log in

Message of the Day - Edit the below file and add your message here.

vi /etc/motd 

If Not working you can check that under sshd_config PrintMotd is set to yes

cat /etc/ssh/sshd_config | grep Print
PrintMotd yes


Next time you login to the instance, you get the defined welcome message: