https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-Universal-Forwarder-on-my-domain-controllers/m-p/170380#M34441 <P>On more than a few of my domain controllers, the Splunk Universal Forwarder is consuming 100% CPU and spewing many errors in splunkd.log like this:</P> <PRE><CODE>06-22-2015 15:26:58.603 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe (/splunk-winevtlog.exe)"" splunk-winevtlog - EvtDC::connectToDC: DsBind failed: (5) </CODE></PRE> <P>This appears to be an issue with the SID resolution as I am collecting Windows Logs on these domain controllers. I'm aware of the evt_dc_name parameter in inputs.conf, but I don't wish to use it because the objects should all be available locally. How do I resolve this issue?</P> Mon, 28 Sep 2020 20:20:28 GMT trademarq 2020-09-28T20:20:28Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-Universal-Forwarder-on-my-domain-controllers/m-p/170380#M34441 <P>On more than a few of my domain controllers, the Splunk Universal Forwarder is consuming 100% CPU and spewing many errors in splunkd.log like this:</P> <PRE><CODE>06-22-2015 15:26:58.603 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe (/splunk-winevtlog.exe)"" splunk-winevtlog - EvtDC::connectToDC: DsBind failed: (5) </CODE></PRE> <P>This appears to be an issue with the SID resolution as I am collecting Windows Logs on these domain controllers. I'm aware of the evt_dc_name parameter in inputs.conf, but I don't wish to use it because the objects should all be available locally. How do I resolve this issue?</P> Mon, 28 Sep 2020 20:20:28 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-Universal-Forwarder-on-my-domain-controllers/m-p/170380#M34441 trademarq 2020-09-28T20:20:28Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-Universal-Forwarder-on-my-domain-controllers/m-p/170381#M34442 <P>Running Splunk 6.2.0 Forwarder in most cases, will upgrade to a newer revision if that is a confirmed fix.</P> Tue, 23 Jun 2015 15:14:20 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-Universal-Forwarder-on-my-domain-controllers/m-p/170381#M34442 trademarq 2015-06-23T15:14:20Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-Universal-Forwarder-on-my-domain-controllers/m-p/170382#M34443 <P>UniversalForwarder+Windows-Permissions=HELL</P> <P>Make sure you have adequate permissions to do all things specified on the forwarder. Not a complete solution but a good place to start.</P> Wed, 24 Jun 2015 00:29:35 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-Universal-Forwarder-on-my-domain-controllers/m-p/170382#M34443 dolivasoh 2015-06-24T00:29:35Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-Universal-Forwarder-on-my-domain-controllers/m-p/170383#M34444 <P><A href="https://msdn.microsoft.com/en-us/ms681382" target="_blank">According to MSDN</A> RPC error code 5 is ERROR_ACCESS_DENIED which definitely gives credence to <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/103802">@dolivasoh</a>'s theory of this being a problem that could easily land one in the <A href="https://en.wikipedia.org/wiki/Inferno_%28Dante%29#Seventh_Circle_.28Violence.29" target="_blank">7th circle</A>. Are you running the UF as a domain user account? There's also discussion about what user you should run Splunk as on Windows and what permissions said user should have at a base level <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Installation/ChoosetheuserSplunkshouldrunas" target="_blank">in the docs</A>.</P> Mon, 28 Sep 2020 20:21:40 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-Universal-Forwarder-on-my-domain-controllers/m-p/170383#M34444 acharlieh 2020-09-28T20:21:40Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-Universal-Forwarder-on-my-domain-controllers/m-p/170384#M34445 <P>I was able to confirm that a security control (Symantec Critical Server Protection / DSP) was preventing the Splunk service from doing what it wanted to do. Resolving the security rules fixed the issue. </P> Wed, 24 Jun 2015 19:44:03 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-Universal-Forwarder-on-my-domain-controllers/m-p/170384#M34445 trademarq 2015-06-24T19:44:03Z