Community:TroubleshootingPDFServer

From Splunk Wiki

Before reading any further, be sure you have read all of the requirements for running the PDF Server and have installed it as directed: http://www.splunk.com/base/Documentation/latest/Installation/ConfigurePDFprintingforSplunkWeb

The PDF server uses firefox to render the reports built from Splunk. Irrespective of a local or remote installation, the basic flow is as follows:

• A Splunk alert is triggered to initiate the PDF reporting process (Unless you visit the status page) - sendemail.py generates the request
• The local appserver makes a call to the specified PDF server and waits for a response from the PDF server.
• PDF server triggers Local python > initiates firefox and X
• Splunk server sends search results (once completed) to the PDF server for rendering
• PDF server sends the rendered PDF back to the Splunk server
• The response is then included in an email alert.

Basic Troubleshooting steps

1. Is the PDF Server installed correctly?
• Did you meet the system requirements?
• The PDF app needs to be unpacked in the $SPLUNK_HOME/etc/apps directory
• Is the xauth package installed correctly on the PDF server?

* > which xauth    
* /usr/bin/xauth

• Is the Xvfb package installed on the PDF server?

* > which Xvfb    
* /usr/bin/Xvfb 

• Check the settings in pdf_server.conf file on the PDF server to make sure the above packages match the correct directory location
• Note - It must be possible to launch the xvfb (X virtual framebuffer) X Server, which is not shipped as part of the app
• The PDF server needs to be enabled in the system settings page in the UI - check alert_actions.conf
2. Does the Status page show up?
• The Remote PDF Report Server URL may need to be manually entered (for local hosts):
• https://127.0.0.1:8089/ (v 4.1.2/3 79803)
• https://127.0.0.1:8089/services/pdfserver/renderpdf
• https://pdfserver.domain.com:8089/services/pdfserver/renderpdf (for a remote host, v 4.1.2 79191)
• You may need to enable the pdf_server.conf settings that allow all entities to create PDF reports/requests. Restart the PDF server after making the change.

[settings]
screenshot_enabled = True
restrict_to_splunkweb = False

3. Does the search/report take more than a minute to return results?
• Since the PDF server waits for the Splunk process to send search results, a long running search may not get sent to the PDF server before a timeout occurs. If this is the case, you should edit the pdf_server.conf on the PDF server and alter the firefox timeout setting to be much larger than the default of 240 seconds.

[settings]
firefox_timeout = 400

Additional specific tips

• If your PDF reports contain ugly fonts make sure you have installed dejavu fonts on your linux system.
• Note that on an x86_64 install of splunk, we will try to run the x86_64 version of the pdfserver, and then if that fails, we will try the i386 version. This means that in the case of a problem with the x86_64 version you will always see messages about i386 as well.
• In order to schedule PDF alerts, the user must be able to schedule searches in general (by default, be of role Power or higher).
• If pdfserver is not working as expected, it might be useful to review $SPLUNK_HOME/var/log/splunk/python.log for pdfserver/pdfhandler messages.
• In some cases you may get more information by enabling web debugging: http://www.splunk.com/base/Documentation/latest/Admin/ContactSupport#Debug_Splunk_Web
• The hostname parameter in the email stanza within alert_actions.conf dictates the address used to call the app server. This host/address must resolve on the local/remote system. If not, you may see a "connection refused" error.
• Do you have a dashboard with a lot of columns? CSS_width_comparison_demo