topic Re: How do I resolve universal forwarder issue with TCP connection (can telnet to 8089 and 9997 though from host)? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-do-I-resolve-universal-forwarder-issue-with-TCP-connection/m-p/646830#M109995 <P>Resolved - Outbound traffic was fine from the AWS host, but inbound traffic to our DC wasn't showing the traffic reaching the heavy forwarder.</P> Tue, 13 Jun 2023 14:44:04 GMT ericzabowski 2023-06-13T14:44:04Z How do I resolve universal forwarder issue with TCP connection (can telnet to 8089 and 9997 though from host)? https://community.splunk.com/t5/Getting-Data-In/How-do-I-resolve-universal-forwarder-issue-with-TCP-connection/m-p/642543#M109515 <P>Hello! Been using the universal forwarder for years connecting to a heavy forwarder currently forwarding to splunk cloud. Installing it on a new AWS host, running into the below errors when data inputs change. I've confirmed that the forwarder is reachable out from the host using telnet.</P> <P>Any Ideas?</P> <P>05-08-2023 10:35:09.570 -0400 INFO AutoLoadBalancedConnectionStrategy [668 TcpOutEloop] - Removing quarantine from idx=10.9.101.133:9997 connid=2<BR />05-08-2023 10:35:09.570 -0400 INFO AutoLoadBalancedConnectionStrategy [668 TcpOutEloop] - Removing quarantine from idx=10.9.101.133:9997 connid=3<BR />05-08-2023 10:35:09.601 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.<BR />05-08-2023 10:35:09.648 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.<BR />05-08-2023 10:35:09.679 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.<BR />05-08-2023 10:35:09.726 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.<BR />05-08-2023 10:35:09.773 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.<BR />05-08-2023 10:35:09.773 -0400 WARN AutoLoadBalancedConnectionStrategy [668 TcpOutEloop] - Applying quarantine to ip=10.9.101.133 port=9997 connid=3 _numberOfFailures=2<BR />05-08-2023 10:35:09.804 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.<BR />05-08-2023 10:35:09.804 -0400 WARN AutoLoadBalancedConnectionStrategy [668 TcpOutEloop] - Applying quarantine to ip=10.9.101.133 port=9997 connid=2 _numberOfFailures=2<BR />05-08-2023 10:35:09.851 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.</P> Tue, 09 May 2023 06:03:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-resolve-universal-forwarder-issue-with-TCP-connection/m-p/642543#M109515 ericzabowski 2023-05-09T06:03:42Z Re: How do I resolve universal forwarder issue with TCP connection (can telnet to 8089 and 9997 though from host)? https://community.splunk.com/t5/Getting-Data-In/How-do-I-resolve-universal-forwarder-issue-with-TCP-connection/m-p/646830#M109995 <P>Resolved - Outbound traffic was fine from the AWS host, but inbound traffic to our DC wasn't showing the traffic reaching the heavy forwarder.</P> Tue, 13 Jun 2023 14:44:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-resolve-universal-forwarder-issue-with-TCP-connection/m-p/646830#M109995 ericzabowski 2023-06-13T14:44:04Z