Univeral Forwarder - Sync but no data transfer

hall_ronald — Fri, 08 Nov 2013 21:45:51 GMT

Two systems (System-1, System-2) each with universal forwarder installed.

Server syncs with both System-x but only receives data from System-1

Same dataset on both systems

Same configuration set on both systems

useACK=true for all outputs in outputs.conf

Server reflects registration to all ports:

Fwd src=192.168.12.2:35476 supports ACK

Fwd src=192.168.12.3:4356 supports ACK

System-1 for which content is forwarded without issue the following is noted:

Connected to idx=192.168.12.1:8002 using ACK.

Received ACK for: 32 - 53

Received ACK for: 63 - 85

...continues verbosely

Data transfer is reflected in tcpdump monitoring of System-1 <-> server

System-2, for which content is not forwarding the following is noted:

Connected to idx=192.168.12.1:8005 using ACK.

Received ACK for: 3 - 3

This exchange is repeated every 15 - 30 seconds with no transfer of data

The sync but no data transfer is reflected in tcpdump monitoring of System-2 <-> Server

Could this behavior be attributable to a network component or NIC configuration?

Re: Univeral Forwarder - Sync but no data transfer

hall_ronald — Fri, 20 Dec 2013 20:38:02 GMT

This was not a network issue ...

The files of interest are .dat (OEM name) and considered by Splunk as binary, by default.

The forwarder opened and processed the file but considered the content binary and did not forward.

The answer, Splunk fails monitoring a log file..., lpolo, 23 Oct '12 provided the information needed to solve the problem