topic Re: macOS UnifiedForwarder in Splunk Enterprise

macOS Universal Forwarder

user487596 — Fri, 22 Nov 2024 22:58:25 GMT

Hello everyone! I need help/hint: I tried to set up log forwarding from MacOS (ARM) to Splunk, but the logs never arrived. I followed the instructions from this video, and also installed and configured Add-on for Unix and Linux. And what index will they appear in? Thanks!

Inside /Applications/SplunkForwarder/etc/system/local i have: inputs.conf, outputs.conf, server.conf.

inputs.conf

[monitor:///var/log/system.log] disabled = 0

outputs.conf

[tcpout:default-autolb-group] server = ip:9997 compressed = true [tcpout-server://ip:9997]

server.conf

[general] serverName = pass4SymmKey = [sslConfig] sslPassword = [lmpool:auto_generated_pool_forwarder] description = auto_generated_pool_forwarder peers = * quota = MAX stack_id = forwarder [lmpool:auto_generated_pool_free] description = auto_generated_pool_free peers = * quota = MAX stack_id = free

Re: macOS UnifiedForwarder

dural_yyz — Fri, 22 Nov 2024 15:04:29 GMT

Look at the local splunkd.log file to see any connection attempts to the destination IP.

Re: macOS UnifiedForwarder

user487596 — Fri, 22 Nov 2024 15:08:45 GMT

WARN TcpOutputProc [22637 parsing] - The TCP output processor has paused the data flow. Forwarding to host_dest=ip inside output group default-autolb-group from host_src= has been blocked for blocked_seconds=16061. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.

ERROR TcpOutputFd [22638 TcpOutEloop] - Read error. Connection reset by peer

It turns out there is no network interaction between the workstation and the splunk?

Re: macOS UnifiedForwarder

dural_yyz — Fri, 22 Nov 2024 15:43:31 GMT

Here we go. So this could be network transmissions so check for firewall blocks and any routing issues first. Then look into SSL connection issues last.