topic Re: Universal Forwarder DsBind failed since upgrade to 6.0.2 in Getting Data In

Universal Forwarder DsBind failed since upgrade to 6.0.2

Ed_Alias — Mon, 03 Mar 2014 16:17:18 GMT

Hi,

i juste upgraded my universal Forwarder on a windows server,

and since it gives me this error in Splunkd.log

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - EvtDC::connectToDC: DsBind failed: (1722)

forwarder is still working but serveclass didn't update ...

help would be greate 😃

Re: Universal Forwarder DsBind failed since upgrade to 6.0.2

itopsdci — Tue, 04 Mar 2014 20:21:07 GMT

Same here. I ran across this while troubleshooting the fact that the wineventlogs stopped coming across on a couple of DCs. Whatever is causing this...not fun.

Re: Universal Forwarder DsBind failed since upgrade to 6.0.2

itopsdci — Mon, 28 Sep 2020 16:02:23 GMT

FYI, I resolved this in my own Splunk deployment. In $SPLUNK_HOME/etc/apps/$WINDOWS_ADDON/local/inputs.conf I had quotes around our domain name for evt_dc_name. I removed them, the problem went away, and our wineventlog:security events stopped being delayed. This behavior began after upgrading our deployment to 6.0.2.

Re: Universal Forwarder DsBind failed since upgrade to 6.0.2

Ed_Alias — Wed, 05 Mar 2014 08:36:43 GMT

And thanks to you my forwader is happy again ! :

TcpOutputProc - Connected to idx=10.2xx.xxx.xxx:9997 using ACK

Thank you !

Re: Universal Forwarder DsBind failed since upgrade to 6.0.2

robert_miller — Mon, 21 Jul 2014 21:26:22 GMT

I have that field blank and I am still getting the errors. We use multiple domains so I am not sure if putting in a domain name is feasible. Any other ideas?

Re: Universal Forwarder DsBind failed since upgrade to 6.0.2

arber — Mon, 05 Jan 2015 14:20:14 GMT

Same problem even with version 6.2 is there any fix on this ?

Re: Universal Forwarder DsBind failed since upgrade to 6.0.2

chanfoli — Tue, 29 Sep 2020 07:27:31 GMT

If you are seeing these errors with a basic event logging setup and you don't have your universal forwarders talking to AD to resolve AD objects in events, you might want to try this in your inputs.conf:

evt_resolve_ad_obj = 0

This tells the forwarder not to try to resolve AD objects. The default with this input type is to do so but if you don't set up the AD binding with evt_dc_name or evt_dns_name it does not work so you will see tons of these errors.

Re: Universal Forwarder DsBind failed since upgrade to 6.0.2

nk-1 — Tue, 29 Sep 2020 07:52:44 GMT

Adding

[default]

evt_resolve_ad_obj = 0

to inputs.conf (on our Universal Forwarders) fixed the problem here when our Windows AD server changed.

Thanks!

Re: Universal Forwarder DsBind failed since upgrade to 6.0.2

boopaljothi — Wed, 06 Jan 2016 22:36:07 GMT

do we need to add this in limits.conf or inputs.conf?

Re: Universal Forwarder DsBind failed since upgrade to 6.0.2

nk-1 — Wed, 06 Jan 2016 22:44:07 GMT

SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf
only, in my setup.
My apologies for the previous typo. Will fix it.

Re: Universal Forwarder DsBind failed since upgrade to 6.0.2

boopaljothi — Sat, 09 Jan 2016 01:28:45 GMT

i still get the same error even after adding that

Re: Universal Forwarder DsBind failed since upgrade to 6.0.2

slebbie_splunk — Tue, 29 Sep 2020 17:54:50 GMT

@arber have you tried the

[default]
evt_resolve_ad_obj = 0

fix?