UBA - Splunk UBA services down due to kernel version mismatch.

Available Languages

Updated:October 1, 2026

Document ID:SPLK051551

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

UBA 5.4.1

Description

The UBA node experienced repeated service interruptions. Health check output and service status indicated services on Node 1 were not running.

Run the health check using:
/opt/caspida/bin/utils/uba_health_check.sh

Output file:

/var/log/caspida/check/uba_health_check.txt
Check the concern summary for failed services on the affected node.

From the Health check it was found that the services are "not running" on Node 1.

Investigation

Verify Kernel Version Consistency Across Nodes
hostnamectl status
Upon comparison, found a discrepancy: Node 1 was running a newer kernel version (4.18.0-553.42.1) compared to remaining nodes (4.18.0-553). This version misalignment was determined to be the likely cause of inconsistent service behavior on Node 1.

On node 1:

Remaining nodes:

Resolution

Align kernel versions:
Standardize the kernel version across all UBA nodes by upgrading the nodes with lower kernel versions to match the higher version on Node 1: 4.18.0-553.42.1.el8_10.x86_64
This alignment removed the version gap impacting service failure.
Restarted the UBA services:
After the kernel version alignment, restarted all services using below command:
/opt/caspida/bin/Caspida stop-all && /opt/caspida/bin/Caspida start-all
Post-upgrade of kernel version, all nodes ran the same kernel version. UBA services have stabilized, the UI is accessible, and no further unplanned shutdowns have been observed.

UI: