topic Splunk Universal forwarder management port is closed in Splunk Enterprise

Splunk Universal forwarder management port is closed

eduardo1989 — Fri, 02 Feb 2024 22:07:20 GMT

Hi All,

I updated Splunk Universal forwarder from 8.2.6 to 9.1.3 on a Debian host. No specific configuration basically, everything by default. I would like to use the REST capabilities which I already used with the older version but this time the port is not listening, however startup says its listening.
Checking mgmt port [8089]: open
Netstat shows no 8089 as well.
Host has no firewall, no bulls**t, just pure playground and as I said older version worked perfectly.
What can be the problem, another bug in the software?

Re: Splunk Universal forwarder management port is closed

richgalloway — Sat, 03 Feb 2024 13:40:51 GMT

The report at startup indicates port 8089 is not in use by any process (it's "open" for use). It does not mean Splunk is listening on that port (at least not yet).

Version 9.0 changed the default behavior of the UF's management port. See the Release Notes at https://docs.splunk.com/Documentation/Splunk/9.0.8/ReleaseNotes/MeetSplunk#What.27s_New_in_9.0

https://docs.splunk.com/Documentation/Splunk/9.0.8/ReleaseNotes/MeetSplunk#What.27s_New_in_9.0

Re: Splunk Universal forwarder management port is closed

eduardo1989 — Sat, 03 Feb 2024 02:35:23 GMT

The thing is it does not listen at all on Linux after the mentioned version. On windows I could check and it works as defined. As it is written by default it is limited to localhost.

Anyways thanks for this info.

Re: Splunk Universal forwarder management port is closed

richgalloway — Sat, 03 Feb 2024 13:41:45 GMT

What you described is the new default behavior.

Re: Splunk Universal forwarder management port is closed

edmondpalcsarbi — Sat, 03 Feb 2024 14:03:31 GMT

Yes, in the meantime it turned out the default way it to listen on a UNIX Domain Socket and I need to switch with config back to the tcp method. 🙂

Re: Splunk Universal forwarder management port is closed

ww9rivers — Mon, 22 Apr 2024 18:27:04 GMT

I am having the same issue. I have also checked the Release Notes you linked. I already have those items configured:

$ bin/splunk btool web list | grep mgmtHostPort
mgmtHostPort = 0.0.0.0:8089
$ bin/splunk btool server list | grep disableDefaultPort
disableDefaultPort = false

But still, I don't see splunkd listening on port 8089:
$ sudo lsof -i tcp -P | grep 8089

(I get nothing.)

The Universal Forwarder is v9.2.1 on Red Hat Enterprise Linux 8.9.

Re: Splunk Universal forwarder management port is closed

patelmc19 — Thu, 31 Oct 2024 23:00:29 GMT

What do you mean by need to switch with config back to the tcp method?
How did you do that?

after this change do you see it listen to port 8089?

netstat -pant | egrep 8089 - do you see listen ?

Re: Splunk Universal forwarder management port is closed

ww9rivers — Fri, 01 Nov 2024 20:50:17 GMT

This is what I have in "server.conf", in addition to what I have in "web.conf":

[httpServer] disableDefaultPort = false mgmtMode = tcp

After that, splunkd starts to listen to TCP port 8089.