From Splunk Wiki

Jump to: navigation, search


Before reading any further, be sure you have read all of the requirements for running the PDF Server and have installed it as directed:

A note on System Requirements/Dependencies

Note: The docs are are incomplete in regards to basic system requirements. Specifically, with CentOS 6.4 Minimal as the base OS, installing the pdfserver app does not install all of the dependencies for firefox to run. Attempting to generate a PDF results in python.log entries such as:

ERROR     pdfhandler:422 - Execution of Firefox to create profile under x86_64 failed
ERROR Execution of Firefox to create profile under x86_64 failed
ERROR     pdfhandler:422 - Execution of Firefox to create profile under i386 failed
ERROR Execution of Firefox to create profile under i386 failed
ERROR     pdfhandler:536 - Failed to start any version of Firefox
ERROR Failed to start any version of Firefox
ERROR     pdfhandler:761 - (500) Failed to generate a report using Firefox: Failed to start: Check that all Firefox dependencies are met
ERROR (500) Failed to generate a report using Firefox: Failed to start: Check that all Firefox dependencies are met
WARNING   xvfb:132 - Stopping X Server 5
WARNING Stopping X Server 5
ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: PDF server at /services/pdfserver/renderpdf returned error: Failed to generate a report using Firefox: Failed to start: Check that all Firefox dependencies are met

A quick solution for CentOS 6.4 Minimal is to install firefox using yum, which will install the required dependencies.

yum install firefox

After installation completes, the bundled version of firefox will also be able to run.

Overview of how pdfserver works

The PDF server uses firefox to render the reports built from Splunk. Irrespective of a local or remote installation, the basic flow is as follows:

  • A Splunk alert is triggered to initiate the PDF reporting process (Unless you visit the status page) - generates the request
  • The local appserver makes a call to the specified PDF server and waits for a response from the PDF server.
  • PDF server triggers Local python > initiates firefox and X
  • Splunk server sends search results (once completed) to the PDF server for rendering
  • PDF server sends the rendered PDF back to the Splunk server
  • The response is then included in an email alert.

Basic Troubleshooting steps

Checking that the PDF server is installed correctly

  1. Is the PDF Server installed correctly?
    • Did you meet the system requirements?
    • The PDF app needs to be unpacked in the $SPLUNK_HOME/etc/apps directory
    • Is the xauth package installed correctly on the PDF server?
    * > which xauth    
    * /usr/bin/xauth
    • Is the Xvfb package installed on the PDF server?
    * > which Xvfb    
    * /usr/bin/Xvfb 
    • Check the settings in pdf_server.conf file on the PDF server to make sure the above packages match the correct directory location
    • Note - It must be possible to launch the xvfb (X virtual framebuffer) X Server, which is not shipped as part of the app
    • The PDF server needs to be enabled in the system settings page in the UI - check alert_actions.conf
  2. Does the Status page show up?
  3. [settings]
    screenshot_enabled = True
    restrict_to_splunkweb = False
    • You may need to download and install bitstrea-vera-fonts manually:
    * wget
    * wget
    * yum localinstall bitstream-vera-fonts-common-1.10-18.el6.noarch.rpm bitstream-vera-fonts-1.10-18.el6.src.rpm 
  4. Does the search/report take more than a minute to return results?
    • Since the PDF server waits for the Splunk process to send search results, a long running search may not get sent to the PDF server before a timeout occurs. If this is the case, you should edit the pdf_server.conf on the PDF server and alter the firefox timeout setting to be much larger than the default of 240 seconds.
    firefox_timeout = 400

Errors and how to fix them

'PDF generation Not Supported' Error

If you attempt to "schedule PDF delivery" of a dashboard and get an error message that "PDF generation isn't supported on this platform":

  • This indicates that the pdfserver is not enabled. Check alert_actions.conf ($SPLUNK_HOME/etc/system/local/alert_actions.conf) and ensure under the [email] stanza, you have reportServerEnabled set to 1 (or true).
reportServerEnabled = 1

python.log: ERROR (400) Invalid target URL supplied

This error is due to the pdfhandler accessing the wrong part of the request object. This can be easily fixed by patching the file as follows:

--- pdfserver/bin/	2011-12-02 15:00:00.000000000 +0100
+++ pdfserver/bin/	2014-07-25 12:45:04.309679502 +0200
@@ -6,7 +6,9 @@
 import subprocess, os, tempfile, shutil, socket, time, platform
 import httplib2
 from urlparse import urlsplit
+import urlparse
 from urllib import splitnport
+import urllib
 from datetime import datetime
 import splunk.util as util
@@ -639,7 +641,10 @@
     def handle_POST(self):
         response = self.response
         request = self.request
-        form = request['form']
+        form = {}
+        for el in request['payload'].split('&'):
+                key, value = el.split('=')
+                form[key] = urllib.unquote(value)
         self.settings = settings = splunk.clilib.cli_common.getConfStanza('pdf_server', 'settings')
         ffparams = {}

Additional specific tips

  • If your PDF reports contain ugly fonts make sure you have installed dejavu fonts on your linux system.
  • Note that on an x86_64 install of splunk, we will try to run the x86_64 version of the pdfserver, and then if that fails, we will try the i386 version. This means that in the case of a problem with the x86_64 version you will always see messages about i386 as well.
  • In order to schedule PDF alerts, the user must be able to schedule searches in general (by default, be of role Power or higher).
  • If pdfserver is not working as expected, it might be useful to review $SPLUNK_HOME/var/log/splunk/python.log for pdfserver/pdfhandler messages.
  • In some cases you may get more information by enabling web debugging:
  • The hostname parameter in the email stanza within alert_actions.conf dictates the address used to call the app server. This host/address must resolve on the local/remote system. If not, you may see a "connection refused" error.
  • Do you have a dashboard with a lot of columns? CSS_width_comparison_demo
Personal tools
Hot Wiki Topics

About Splunk >
  • Search and navigate IT data from applications, servers and network devices in real-time.
  • Download Splunk