If you need to restart a Gravwell service, such as to apply changes to a config file or bring online a new listener, the process is pretty simple and straightforward. Gravwell's installers include the required Systemd unit files which will allow you to manage the processes via the Standard Linux systemctl process.
Each Gravwell process can be stopped, started, or restarted individually, or by specifying multiple services in a single CLI command.
sudo systemctl start <Gravwell Service(s)>
sudo systemctl stop <Gravwell Service(s)>
sudo systemctl restart <Gravwell Service(s)>
You may also check the status of a Gravwell service with systemctl to ensure the process restarted successfully and is in a running state.
sudo systemctl status <Gravwell Service(s)>
Windows ingester services can also be managed via the Windows Service Manager.
Troubleshooting
If a service fails to start, the Crash Reporter will output a crash log into the /opt/gravwell/log/crash directory. Check this location for the timestamped logs of the specific Gravwell Service that failed and you can locate error messages associate with the process failure. Common issues can include syntax errors, typos, or problems binding to a port.
Gravwell Services
| Gravwell Component | Gravwell Service Name |
|---|---|
| Indexer | gravwell_indexer |
| Webserver | gravwell_webserver |
| Simple Relay | gravwell_simple_relay |
| Federator | gravwell_federator |
| Search Agent | gravwell_searchagent |
| Datastore | gravwell_datastore |
| Netflow Capture | gravwell_netflow_capture |
| Network Capture (pcap) | gravwell_network_capture |
| Collectd | gravwell_collectd |
| File Follow | gravwell_file_follow |
| Http Ingester | gravwell_http_ingester |
| Ipmi | gravwell_ipmi |
| Kafka Federator | gravwell_kafka_federator |
| Kafka Ingester | gravwell_kafka |
| Kinesis | gravwell_kinesis |
| Gravwell Loadbalancer | gravwell_loadbalancer |
| MSGraph | gravwell_msgraph |
| Office 365 | gravwell_o365 |
| Offline Replication | gravwell_offline_replication |
| Packet Fleet | gravwell_packet_fleet |
| PubSub | gravwell_pubsub |
| S3 Ingester | gravwell_s3 |
| Shodan | gravwell_shodan |
| SNMP Trap Ingester | gravwell_snmp |
| Amazon SQS Ingester | gravwell_sqs |
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article