topic Re: Splunk Add-on for Cisco IPS: Why am I receiving "URLError: urlopen error [Errno 104] Connection reset by peer"? in All Apps and Add-ons

Splunk Add-on for Cisco IPS: Why am I receiving "URLError: urlopen error [Errno 104] Connection reset by peer"?

paguayof — Mon, 23 Feb 2015 12:33:25 GMT

Hello there,

I have an issue obtaining logs from an IPS.......I can add the IPS correctly, but then I receive this logs.

[root@localhost splunk]# tail -f sdee_get.log 
Fri Feb 20 17:41:43 2015 - INFO - Checking for exsisting SubscriptionID on host: 10.201.158.35
Fri Feb 20 17:41:43 2015 - INFO - No exsisting SubscriptionID for host: 10.201.158.35
Fri Feb 20 17:41:43 2015 - INFO - Attempting to connect to sensor: 10.201.158.35
Fri Feb 20 17:41:43 2015 - INFO - Successfully connected to: 10.201.158.35
Fri Feb 20 17:41:44 2015 - ERROR - Connecting to sensor - 10.201.158.35: URLError: urlopen error [Errno 104] Connection reset by peer>

Splunk is in the Allowed host list in the IPS

Someone knows whats going on?

Re: Splunk Add-on for Cisco IPS: Why am I receiving "URLError: urlopen error [Errno 104] Connection reset by peer"?

hortonew — Tue, 24 Feb 2015 23:55:15 GMT

Check my post here and see if this is related: http://blog.hortonew.com/splunk-ciscoips-app-no-longer-pulls-from-ips

Re: Splunk Add-on for Cisco IPS: Why am I receiving "URLError: urlopen error [Errno 104] Connection reset by peer"?

jcoates_splunk — Sat, 14 Mar 2015 23:45:49 GMT

Hi, I don't think that patch is valid any more, as we've made some changes to the connection code.

Re: Splunk Add-on for Cisco IPS: Why am I receiving "URLError: urlopen error [Errno 104] Connection reset by peer"?

jcoates_splunk — Sat, 14 Mar 2015 23:46:09 GMT

Is the IPS hitting its maximum allotment of connections?

Re: Splunk Add-on for Cisco IPS: Why am I receiving "URLError: urlopen error [Errno 104] Connection reset by peer"?

hortonew — Sun, 15 Mar 2015 16:15:00 GMT

Good to know, thanks.

Re: Splunk Add-on for Cisco IPS: Why am I receiving "URLError: urlopen error [Errno 104] Connection reset by peer"?

bmas10 — Sat, 11 Jun 2016 18:04:41 GMT

I updated the SSL to use TLS as stated in the http://docs.splunk.com/Documentation/AddOns/latest/CiscoIPS/Troubleshooting to get around this issue.