Community:TroubleshootingPDFServer
From Splunk Wiki
Prerequisites
Before reading any further, be sure you have read all of the requirements for running the PDF Server and have installed it as directed: http://docs.splunk.com/Documentation/Splunk/4.3.6/Installation/ConfigurePDFprintingforSplunkWeb
A note on System Requirements/Dependencies
Note: The docs are are incomplete in regards to basic system requirements. Specifically, with CentOS 6.4 Minimal as the base OS, installing the pdfserver app does not install all of the dependencies for firefox to run. Attempting to generate a PDF results in python.log entries such as:
ERROR pdfhandler:422 - Execution of Firefox to create profile under x86_64 failed ERROR Execution of Firefox to create profile under x86_64 failed ERROR pdfhandler:422 - Execution of Firefox to create profile under i386 failed ERROR Execution of Firefox to create profile under i386 failed ERROR pdfhandler:536 - Failed to start any version of Firefox ERROR Failed to start any version of Firefox ERROR pdfhandler:761 - (500) Failed to generate a report using Firefox: Failed to start: Check that all Firefox dependencies are met ERROR (500) Failed to generate a report using Firefox: Failed to start: Check that all Firefox dependencies are met WARNING xvfb:132 - Stopping X Server 5 WARNING Stopping X Server 5 ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: PDF server at /services/pdfserver/renderpdf returned error: Failed to generate a report using Firefox: Failed to start: Check that all Firefox dependencies are met
A quick solution for CentOS 6.4 Minimal is to install firefox using yum, which will install the required dependencies.
yum install firefox
After installation completes, the bundled version of firefox will also be able to run.
Overview of how pdfserver works
The PDF server uses firefox to render the reports built from Splunk. Irrespective of a local or remote installation, the basic flow is as follows:
- A Splunk alert is triggered to initiate the PDF reporting process (Unless you visit the status page) - sendemail.py generates the request
- The local appserver makes a call to the specified PDF server and waits for a response from the PDF server.
- PDF server triggers Local python > initiates firefox and X
- Splunk server sends search results (once completed) to the PDF server for rendering
- PDF server sends the rendered PDF back to the Splunk server
- The response is then included in an email alert.
Basic Troubleshooting steps
Checking that the PDF server is installed correctly
- Is the PDF Server installed correctly?
- Did you meet the system requirements?
- The PDF app needs to be unpacked in the $SPLUNK_HOME/etc/apps directory
- Is the xauth package installed correctly on the PDF server?
- Is the Xvfb package installed on the PDF server?
- Check the settings in pdf_server.conf file on the PDF server to make sure the above packages match the correct directory location
- Note - It must be possible to launch the xvfb (X virtual framebuffer) X Server, which is not shipped as part of the app
- The PDF server needs to be enabled in the system settings page in the UI - check alert_actions.conf
- Does the Status page show up?
- The Remote PDF Report Server URL may need to be manually entered (for local hosts):
- https://127.0.0.1:8089/ (v 4.1.2/3 79803)
- https://127.0.0.1:8089/services/pdfserver/renderpdf
- https://pdfserver.domain.com:8089/services/pdfserver/renderpdf (for a remote host, v 4.1.2 79191)
- You may need to enable the pdf_server.conf settings that allow all entities to create PDF reports/requests. Restart the PDF server after making the change.
- You may need to download and install bitstrea-vera-fonts manually:
- Does the search/report take more than a minute to return results?
- Since the PDF server waits for the Splunk process to send search results, a long running search may not get sent to the PDF server before a timeout occurs. If this is the case, you should edit the pdf_server.conf on the PDF server and alter the firefox timeout setting to be much larger than the default of 240 seconds.
* > which xauth * /usr/bin/xauth
* > which Xvfb * /usr/bin/Xvfb
[settings] screenshot_enabled = True restrict_to_splunkweb = False
* wget http://dl.atrpms.net/all/bitstream-vera-fonts-common-1.10-18.el6.noarch.rpm * wget http://dl.atrpms.net/src/el6-i386/atrpms/stable/bitstream-vera-fonts-1.10-18.el6.src.rpm * yum localinstall bitstream-vera-fonts-common-1.10-18.el6.noarch.rpm bitstream-vera-fonts-1.10-18.el6.src.rpm
[settings] firefox_timeout = 400
Errors and how to fix them
'PDF generation Not Supported' Error
If you attempt to "schedule PDF delivery" of a dashboard and get an error message that "PDF generation isn't supported on this platform":
- This indicates that the pdfserver is not enabled. Check alert_actions.conf ($SPLUNK_HOME/etc/system/local/alert_actions.conf) and ensure under the [email] stanza, you have reportServerEnabled set to 1 (or true).
[email] reportServerEnabled = 1
python.log: ERROR (400) Invalid target URL supplied
This error is due to the pdfhandler accessing the wrong part of the request object. This can be easily fixed by patching the pdfhandler.py file as follows:
--- pdfserver/bin/pdfhandler.py 2011-12-02 15:00:00.000000000 +0100
+++ pdfserver/bin/pdfhandler.py 2014-07-25 12:45:04.309679502 +0200
@@ -6,7 +6,9 @@
import subprocess, os, tempfile, shutil, socket, time, platform
import httplib2
from urlparse import urlsplit
+import urlparse
from urllib import splitnport
+import urllib
from datetime import datetime
import splunk.util as util
@@ -639,7 +641,10 @@
def handle_POST(self):
response = self.response
request = self.request
- form = request['form']
+ form = {}
+ for el in request['payload'].split('&'):
+ key, value = el.split('=')
+ form[key] = urllib.unquote(value)
self.settings = settings = splunk.clilib.cli_common.getConfStanza('pdf_server', 'settings')
self.migrate()
ffparams = {}
Additional specific tips
- If your PDF reports contain ugly fonts make sure you have installed dejavu fonts on your linux system.
- Note that on an x86_64 install of splunk, we will try to run the x86_64 version of the pdfserver, and then if that fails, we will try the i386 version. This means that in the case of a problem with the x86_64 version you will always see messages about i386 as well.
- In order to schedule PDF alerts, the user must be able to schedule searches in general (by default, be of role Power or higher).
- If pdfserver is not working as expected, it might be useful to review $SPLUNK_HOME/var/log/splunk/python.log for pdfserver/pdfhandler messages.
- In some cases you may get more information by enabling web debugging: http://www.splunk.com/base/Documentation/latest/Admin/ContactSupport#Debug_Splunk_Web
- The hostname parameter in the email stanza within alert_actions.conf dictates the address used to call the app server. This host/address must resolve on the local/remote system. If not, you may see a "connection refused" error.
- Do you have a dashboard with a lot of columns? CSS_width_comparison_demo
