topic Re: HttpListener - Socket error from xx.xx.xx.xx:39944 while idling: Read Timeout in Getting Data In

HttpListener - Socket error from xx.xx.xx.xx:39944 while idling: Read Timeout

emallinger — Thu, 25 Mar 2021 10:48:31 GMT

Hello everyone,

Could you please point me in the right direction ?

I'm trying to get a universal fowarder to talk to my splunk instance (mono-instance).

I've set the deployer Server correctly on the forwarder (done and checked multiple times, used with other forwarders).

On the forwarder : debian 10, w splunf uf 8.0.4 or 8.1.2 or 8.0.5

tcptraceroute to my-manager.fr:8089 => ok

telnet => opening connection

curl => empty reply from server

in splunkd.log :

DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

On the manager : debian 9, splunk 8.0.4.1

I've got on index=_internal :

HttpListener - Socket error from xx.xx.xx.xx:39944 while idling: Read Timeout

where xx.xx.xx.xx is the IP of the forwarder.

I've logs on both machines, with DEBUG strategically placed in log.cfg.

I still don't get it.

I don't even understand what is wrong.

Any idea ?

Thanks in advance,

Regards,

Ema

Re: HttpListener - Socket error from xx.xx.xx.xx:39944 while idling: Read Timeout

Vardhan — Thu, 25 Mar 2021 11:05:21 GMT

Hi @emallinger,

Did you check the connectivity from your forwarder to the deployment server? is it connecting?

telnet "ip of deploymentserver" 8089

Re: HttpListener - Socket error from xx.xx.xx.xx:39944 while idling: Read Timeout

SOURAV_S — Thu, 25 Mar 2021 12:34:47 GMT

Hi Ema,

Can you check if these steps are working for you:

https://www.learnsplunk.com/splunk-forwarder-not-sending-data.html

If this works for you, mark this as solution.

Happy Splunking! 🙂

Re: HttpListener - Socket error from xx.xx.xx.xx:39944 while idling: Read Timeout

emallinger — Thu, 25 Mar 2021 13:30:30 GMT

Hi,

Telnet says "connected to xx.xx.xx.xx"

Ema

Re: HttpListener - Socket error from xx.xx.xx.xx:39944 while idling: Read Timeout

emallinger — Thu, 01 Apr 2021 09:16:04 GMT

Hi everyone,

Seems it was a network problem.

As I understand it, my flux was routed to a gateway that was the usual standard one.

Turned out this was not the one I needed.

I used

route add -net xx.xx.xx.xx/yy gw zz.zz.zz.zz dev eth0

and then an update of

/etc/netword/interfaces.d/eth0

(to permanently add the new route).

to fix the route toward my target monointance.

Works fine now.

Thanks everyone !

Ema