https://community.splunk.com/t5/Getting-Data-In/Handshake-and-socket-error/m-p/113398#M23739 <P><EM>OS for forwarder: Windows Server 2012</EM><BR /> <EM>Splunk + Universal Forwarder version: 6</EM></P> <P>I'm trying to get my Universal Forwarder to contact the deployment server. The only "change" I have done during the installation is setting the deployment server in the msiexec.exe.</P> <P><STRONG>C:\Program Files\SplunkUniversalForwarder\etc\system\local\deploymentclient.conf:</STRONG></P> <BLOCKQUOTE> <P>[target-broker:deploymentServer]<BR /> targetUri = server:port</P> </BLOCKQUOTE> <P><STRONG>C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log:</STRONG></P> <BLOCKQUOTE> <P>10-24-2013 15:46:00.722 +0200 INFO HttpPubSubConnection - Secure HTTP POST failed: Connect to=server:port timed out; exceeded 5sec<BR /> 10-24-2013 15:46:00.722 +0200 INFO HttpPubSubConnection - Could not obtain connection, will retry after=56 seconds.<BR /> 10-24-2013 15:46:08.584 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected<BR /> 10-24-2013 15:46:20.597 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected<BR /> 10-24-2013 15:46:32.609 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected<BR /> 10-24-2013 15:46:44.621 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected<BR /> 10-24-2013 15:46:56.634 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected</P> </BLOCKQUOTE> <P><STRONG>Log from the Splunk server</STRONG></P> <BLOCKQUOTE> <P>10-24-2013 12:33:42.634 +0200 WARN HttpListener - Socket error from X.X.X.X while idling: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request</P> </BLOCKQUOTE> <P>Just for clearity: I can not see my client trying to phone home in under Forwarder management.</P> <P>Have I left out something important in my forwarder configuration? Some suggestions on what I'm doing wrong?</P> Thu, 24 Oct 2013 14:05:56 GMT drberg 2013-10-24T14:05:56Z https://community.splunk.com/t5/Getting-Data-In/Handshake-and-socket-error/m-p/113398#M23739 <P><EM>OS for forwarder: Windows Server 2012</EM><BR /> <EM>Splunk + Universal Forwarder version: 6</EM></P> <P>I'm trying to get my Universal Forwarder to contact the deployment server. The only "change" I have done during the installation is setting the deployment server in the msiexec.exe.</P> <P><STRONG>C:\Program Files\SplunkUniversalForwarder\etc\system\local\deploymentclient.conf:</STRONG></P> <BLOCKQUOTE> <P>[target-broker:deploymentServer]<BR /> targetUri = server:port</P> </BLOCKQUOTE> <P><STRONG>C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log:</STRONG></P> <BLOCKQUOTE> <P>10-24-2013 15:46:00.722 +0200 INFO HttpPubSubConnection - Secure HTTP POST failed: Connect to=server:port timed out; exceeded 5sec<BR /> 10-24-2013 15:46:00.722 +0200 INFO HttpPubSubConnection - Could not obtain connection, will retry after=56 seconds.<BR /> 10-24-2013 15:46:08.584 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected<BR /> 10-24-2013 15:46:20.597 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected<BR /> 10-24-2013 15:46:32.609 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected<BR /> 10-24-2013 15:46:44.621 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected<BR /> 10-24-2013 15:46:56.634 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected</P> </BLOCKQUOTE> <P><STRONG>Log from the Splunk server</STRONG></P> <BLOCKQUOTE> <P>10-24-2013 12:33:42.634 +0200 WARN HttpListener - Socket error from X.X.X.X while idling: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request</P> </BLOCKQUOTE> <P>Just for clearity: I can not see my client trying to phone home in under Forwarder management.</P> <P>Have I left out something important in my forwarder configuration? Some suggestions on what I'm doing wrong?</P> Thu, 24 Oct 2013 14:05:56 GMT https://community.splunk.com/t5/Getting-Data-In/Handshake-and-socket-error/m-p/113398#M23739 drberg 2013-10-24T14:05:56Z https://community.splunk.com/t5/Getting-Data-In/Handshake-and-socket-error/m-p/113399#M23740 <P>Well this is embarassing. Turns out I had the wrong url to the deployment server. It's all good now.</P> Fri, 25 Oct 2013 09:18:52 GMT https://community.splunk.com/t5/Getting-Data-In/Handshake-and-socket-error/m-p/113399#M23740 drberg 2013-10-25T09:18:52Z https://community.splunk.com/t5/Getting-Data-In/Handshake-and-socket-error/m-p/113400#M23741 <P>Same issue i am facing , and i also checked all urls. </P> <P>Please help me on this </P> Sun, 10 Nov 2013 12:54:40 GMT https://community.splunk.com/t5/Getting-Data-In/Handshake-and-socket-error/m-p/113400#M23741 rameshlpatel 2013-11-10T12:54:40Z https://community.splunk.com/t5/Getting-Data-In/Handshake-and-socket-error/m-p/113401#M23742 <P>Maybe it's a firewall in the route to the deployment server?</P> Mon, 11 Nov 2013 08:35:55 GMT https://community.splunk.com/t5/Getting-Data-In/Handshake-and-socket-error/m-p/113401#M23742 drberg 2013-11-11T08:35:55Z