topic Re: Error encountered for connection from src=10.100.100.137:48221. Local side shutting down in Getting Data In

Error encountered for connection from src=10.100.100.137:48221. Local side shutting down

itmonitoring — Fri, 26 Jul 2013 21:17:16 GMT

I'm seeing this error in a heavy forwarder, but I couldn't find any information as to what it could mean.

07-26-2013 14:53:59.324 -0600 ERROR TcpInputProc - Error encountered for connection from src=10.100.100.137:48221. Local side shutting down

The configuration I have is pretty simple:

Host -> HEAVY FORWARDER -> INDEXER

The error above shows up in splunkd.log in the Heavy Forwarder and no data makes it to the indexer.

What does it mean?

Re: Error encountered for connection from src=10.100.100.137:48221. Local side shutting down

sf_user_199 — Thu, 01 Aug 2013 17:27:16 GMT

I've seen this too occasionally with a very similar setup.

Re: Error encountered for connection from src=10.100.100.137:48221. Local side shutting down

rsennett_splunk — Mon, 05 Aug 2013 06:48:53 GMT

Are there other messages earlier in the log?
You might want to take a look at this:
http://splunk-base.splunk.com/answers/43285/error-tcpinputproc-error-encountered-for-connection-from-timeout

Re: Error encountered for connection from src=10.100.100.137:48221. Local side shutting down

sjohnson_splunk — Mon, 01 Aug 2016 17:46:12 GMT

First, are you expecting input from that host? If no, then I suspect that it might be something like a vulnerability scanner probing the HF.

If yes and the HF is linux, how many open files are available? (look in the splunkd.log for ulimit open files). Could be you ran out of file handles if there are a lot of forwarders connecting to the HF.