topic Re: Splunk 6 Ciso ips error in Security

Splunk 6 Ciso ips error

fraijof — Mon, 28 Sep 2020 14:59:29 GMT

I upgraded Splunk to version 6 and data stopped flowing from our CiscoIPS. My sdee_get.log shows this error:
Wed Oct 16 09:16:53 2013 - ERROR - Connecting to sensor - MY IP: URLError:

I dug in deeper and I think its barking at the negotiation of SSL?
/splunk/lib/python2.7/ssl.py

I changed ssl.py ssl_version=PROTOCOL_SSLv23 to ssl_version=PROTOCOL_TLSv1 and still did not work.
I hope to get this online ASAP.

Re: Splunk 6 Ciso ips error

jgauthier — Thu, 17 Oct 2013 18:26:40 GMT

Mine is also broken after upgrading. I am still diagnosing this.

Re: Splunk 6 Ciso ips error

seanp — Mon, 28 Sep 2020 15:00:23 GMT

I had the same issue doing a new install on Splunk 6. I ended up having to install a Splunk 5.0.5 lightweight forwarder on a separate server and forward it to the central server. When I ran

openssl s_client -connect :443

with the version that is included in Splunk 6 but works fine in version 5.0.5. There seems to be an issue with this on Linux, however I experience the same issue with Windows

http://answers.splunk.com/answers/105193/cisco-ips-error-errno-8

Re: Splunk 6 Ciso ips error

jgauthier — Thu, 17 Oct 2013 18:42:48 GMT

I was just uncovering this mess. Wouldn't it be possible to include another openssl library somewhere and reference that?

Re: Splunk 6 Ciso ips error

seanp — Thu, 17 Oct 2013 18:56:41 GMT

I tried the very hackish replacing of the OpenSSL binary files in the bin directory with 0.9.8y but only got errors.

Re: Splunk 6 Ciso ips error

dshpritz — Wed, 14 May 2014 22:39:41 GMT

You may want to check out my answer here: http://answers.splunk.com/answers/105193/cisco-ips-error-errno-8/135759. I posted some code that may solve this issue for you.