Why are Apache access logs not appearing after configuration and ogs show the server is rejecting the connection between itself?

Spiere — Thu, 07 Jan 2016 19:50:29 GMT

Hey guys,

I have configured the forwarder to send apache access logs to itself from localhost. However, when I look at the metrics log for Splunk, I see

01-07-2016 19:34:57.279 +0000 INFO  StatusMgr - destHost=xx.xx.xxx.xxx, destIp=xx.xx.xxx.xxx, destPort=9997, eventType=connect_try, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
01-07-2016 19:34:57.280 +0000 INFO  StatusMgr - destHost=xx.xx.xxx.xxx, destIp=xx.xx.xxx.xxx, destPort=9997, eventType=connect_fail, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor

My inputs.conf file is inside of /opt/splunk/etc/apps/search/local/inputs.conf, and it says -

[splunktcp://9997]
connection_host = ip

[monitor:///var/log/apache2/access.log]
disabled = false
index = main
sourcetype = access_combined

I'm pretty sure I already opened port 9997. When I do it inside of Splunk, it says the port is already open.

Any help would be appreciated.

Thanks

Re: Why are Apache access logs not appearing after configuration and ogs show the server is rejecting the connection between itself?

Spiere — Mon, 11 Jan 2016 18:52:13 GMT

The issue was that the forwarder and the receiver were on the same server, so it was causing a feedback loop and not allowing and new indexes to be processed. Removing the forwarder and all of the configuration relating to it from the server that the receiver was on fixed the issue.

topic Why are Apache access logs not appearing after configuration and ogs show the server is rejecting the connection between itself? in Getting Data In

Why are Apache access logs not appearing after configuration and ogs show the server is rejecting the connection between itself?

Re: Why are Apache access logs not appearing after configuration and ogs show the server is rejecting the connection between itself?