topic Universal forwarder not connecting in Getting Data In

Universal forwarder not connecting

cmaxfield — Thu, 26 Jan 2012 13:58:26 GMT

I've been trying to set up a universal forwarder to send to Splunk, and it doesn't appear to want to connect. Here's my current outputs.conf:

[tcpout]
defaultGroup = 172.31.**.**_9997

[tcpout:172.31.**.**_9997]
server = 172.31.**.**:9997

[tcpout-server://172.31.**.**:9997]
compressed = false
indexAndForward = false
sslCertPath = /opt/splunkforwarder/etc/auth/server.pem
sslPassword = $1$Ljp9kArNr5Od
sslRootCAPath = /opt/splunkforwarder/etc/auth/cacert.pem
sslVerifyServerCert = false

And this is what I get when I list forward-server:

Active forwards:
        None
Configured but inactive forwards:
        172.31.**.**:9997 (ssl)

My receiver is set up, receives data from other forwarders per our security guy. Any suggestions? We found a firewall issue yesterday, so that got removed. Now our firewall is showing the packets going out. Not sure if I just need to restart our Splunk server, or what. Security guy doesn't want to do that though as we currently have other forwarders sending info to it.

Re: Universal forwarder not connecting

kristian_kolb — Thu, 26 Jan 2012 14:25:05 GMT

If the other data coming into the Splunk server is sent from other forwarders, you could probably restart the server without problem, the forwarders will notice that the server is down and continue sending when it's up again.

If your Splunk server also receives syslog data (over UDP) you will lose data during a restart, as the sending party will have no way of knowing that the data got lost.

Re: Universal forwarder not connecting

cmaxfield — Thu, 26 Jan 2012 14:46:10 GMT

I don't know what the data is, whether it's UDP vs TCP. Which is why I don't want to shut it off while he's on vacation. If I absolutely need to, then I will. But would rather do whatever I can to the forwarder first to be 115% certain it's not that.

Re: Universal forwarder not connecting

mship — Wed, 23 Jan 2013 16:44:37 GMT

You won't lose any data if you restart the server or splunkd because the syslog will still be present on the local system (or switch etc.) that is sending it and you can always pull it from there.