https://community.splunk.com/t5/Getting-Data-In/Cisco-ironport-syslog-broken-pipe/m-p/353733#M64741 <P>Hello</P> <P>I configured Splunk to handle TCP syslog from ironport appliances:</P> <PRE><CODE>[tcp://514] connection_host = dns index = ironport source = mailinfra sourcetype = cisco:esa:textmail queueSize = 10MB </CODE></PRE> <P>but there is quite a lot of alerts on ironport side:</P> <PRE><CODE>Log Error: Subscription mrelay_mail_logs: Network error while sending log data to syslog server 10.91.2.3 (10.1.2.3): [Errno 32] Broken pipe </CODE></PRE> <P>Ironport sends the logs on a VIP which is forwarder to a pool of Splunk Heavy Forwarders.</P> <P>I'm gonna check if mulitples TCP sessions can be optimized on the loadbalancer but is there any specific Splunk inputs.conf parameter I should check as well? thanks.</P> Tue, 14 Mar 2017 09:06:18 GMT sassens1 2017-03-14T09:06:18Z https://community.splunk.com/t5/Getting-Data-In/Cisco-ironport-syslog-broken-pipe/m-p/353733#M64741 <P>Hello</P> <P>I configured Splunk to handle TCP syslog from ironport appliances:</P> <PRE><CODE>[tcp://514] connection_host = dns index = ironport source = mailinfra sourcetype = cisco:esa:textmail queueSize = 10MB </CODE></PRE> <P>but there is quite a lot of alerts on ironport side:</P> <PRE><CODE>Log Error: Subscription mrelay_mail_logs: Network error while sending log data to syslog server 10.91.2.3 (10.1.2.3): [Errno 32] Broken pipe </CODE></PRE> <P>Ironport sends the logs on a VIP which is forwarder to a pool of Splunk Heavy Forwarders.</P> <P>I'm gonna check if mulitples TCP sessions can be optimized on the loadbalancer but is there any specific Splunk inputs.conf parameter I should check as well? thanks.</P> Tue, 14 Mar 2017 09:06:18 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-ironport-syslog-broken-pipe/m-p/353733#M64741 sassens1 2017-03-14T09:06:18Z https://community.splunk.com/t5/Getting-Data-In/Cisco-ironport-syslog-broken-pipe/m-p/353734#M64742 <P>Same problem here ? May I know any solution that I can do ? thanks</P> Fri, 12 May 2017 01:16:25 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-ironport-syslog-broken-pipe/m-p/353734#M64742 hkhkgais 2017-05-12T01:16:25Z