https://community.splunk.com/t5/Getting-Data-In/WARN-SSLCommon-53742-FwdDataReceiverThread-Received-fatal-SSL3/m-p/706050#M116782 <P>Hello guys,</P><P>We are getting on one heavyforwarder this message in splunkd.log, we are using TCP-SSL inputs.conf :</P><P>“11-14-2024 16:59:44.129 +0100 WARN&nbsp; SSLCommon [53742 FwdDataReceiverThread] - Received fatal SSL3 alert. ssl_state='SSLv3 read client certificate A', alert_description='unknown CA'.”</P><P>&nbsp;</P><P><STRONG>How do you identify the sourceHost ? Is it blocking incoming data or just warning?</STRONG></P><P>&nbsp;</P><P>Maybe this can help? index=_* host=myhf1 source="/OPT/splunk/var/log/splunk/metrics.log" tcp_Kprocessed="0.000"</P><P>&nbsp;</P><P>Thanks for your help.</P> Thu, 05 Dec 2024 18:43:10 GMT splunkreal 2024-12-05T18:43:10Z https://community.splunk.com/t5/Getting-Data-In/WARN-SSLCommon-53742-FwdDataReceiverThread-Received-fatal-SSL3/m-p/706050#M116782 <P>Hello guys,</P><P>We are getting on one heavyforwarder this message in splunkd.log, we are using TCP-SSL inputs.conf :</P><P>“11-14-2024 16:59:44.129 +0100 WARN&nbsp; SSLCommon [53742 FwdDataReceiverThread] - Received fatal SSL3 alert. ssl_state='SSLv3 read client certificate A', alert_description='unknown CA'.”</P><P>&nbsp;</P><P><STRONG>How do you identify the sourceHost ? Is it blocking incoming data or just warning?</STRONG></P><P>&nbsp;</P><P>Maybe this can help? index=_* host=myhf1 source="/OPT/splunk/var/log/splunk/metrics.log" tcp_Kprocessed="0.000"</P><P>&nbsp;</P><P>Thanks for your help.</P> Thu, 05 Dec 2024 18:43:10 GMT https://community.splunk.com/t5/Getting-Data-In/WARN-SSLCommon-53742-FwdDataReceiverThread-Received-fatal-SSL3/m-p/706050#M116782 splunkreal 2024-12-05T18:43:10Z