topic Re: How to resolve "tcp-rst-from-server" & "tcp-rst-from-client" errors in Getting Data In

How to resolve "tcp-rst-from-server" & "tcp-rst-from-client" errors?

yossefn — Thu, 31 Mar 2022 13:18:48 GMT

Hi,

I'm trying to collect logs from a web servers, but getting an error on the FIrewall says "tcp-rst-from-server" on port 9997. Also, I have another error "tcp-rst-from-client" on port 8089.

I have to say that there are other servers in the same VLAN that I'm getting logs from.

Where can I look to solve the problem?

Re: How to resolve "tcp-rst-from-server" & "tcp-rst-from-client" errors

sbaror11 — Wed, 11 Nov 2020 10:51:16 GMT

Is it a question about Splunk or about the web servers?

tcp reset from client or from servers is a layer-2 error which refers to an application layer related event

It can be described as "the client or server terminated the session but I don't know why"

You can look at the application (http/https) logs to see the reason.

Re: How to resolve "tcp-rst-from-server" & "tcp-rst-from-client" errors

yossefn — Wed, 11 Nov 2020 11:40:48 GMT

Hi @sbaror11,

The question is about Splunk - wondered if maybe Splunk denied somehow the connection, or I missed some configuration that preventing me from getting the logs.

I had kind of issue with "aged-out" errors on the FW logs, then I figured out that the local FW on the Splunk servers denied the connection.

Re: How to resolve "tcp-rst-from-server" & "tcp-rst-from-client" errors

kgalibert — Thu, 31 Mar 2022 10:05:27 GMT

Hi,

Do you have find your solution?

Have same issue between an UF on Windows server AD and an UF Relay.

Thans