topic Re: Sourcefire estreamer.log stopped getting data after Sourcefire update in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Sourcefire-estreamer-log-stopped-getting-data-after-Sourcefire/m-p/54758#M96855 <P>Thanks. What is function of ssl_test.pl? I've renamed it so it won't run. Doesn't seem to affect the splunk server. Before disabling, about every three weeks, ssl_test.pl would spawn run-away processes and slow the server way down. I'd have to manually killall of the ssl_test.pl PIDs.</P> Mon, 28 Sep 2020 13:42:26 GMT johnwsrns 2020-09-28T13:42:26Z Sourcefire estreamer.log stopped getting data after Sourcefire update https://community.splunk.com/t5/Getting-Data-In/Sourcefire-estreamer-log-stopped-getting-data-after-Sourcefire/m-p/54756#M96853 <P>No data in estreamer.log after Sourcefire update. SSL test shows connection to Sourcefire server is up. I've restarted splunkd but still no data. Any suggestions?</P> Wed, 05 Dec 2012 14:08:08 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcefire-estreamer-log-stopped-getting-data-after-Sourcefire/m-p/54756#M96853 johnwsrns 2012-12-05T14:08:08Z Re: Sourcefire estreamer.log stopped getting data after Sourcefire update https://community.splunk.com/t5/Getting-Data-In/Sourcefire-estreamer-log-stopped-getting-data-after-Sourcefire/m-p/54757#M96854 <P>Had a similar situation: estream stopped flowing after a network outage that took the SDC-splunk link down...</P> <P>Ended up manually removing pid files in apps/Sourcefire/tmp ; archiving logs in ../log</P> <P>However, most likely, it's the bookmark reset (./ssl_test.pl -start=now ) that helped...</P> Tue, 09 Apr 2013 20:00:07 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcefire-estreamer-log-stopped-getting-data-after-Sourcefire/m-p/54757#M96854 agrachevBLK 2013-04-09T20:00:07Z Re: Sourcefire estreamer.log stopped getting data after Sourcefire update https://community.splunk.com/t5/Getting-Data-In/Sourcefire-estreamer-log-stopped-getting-data-after-Sourcefire/m-p/54758#M96855 <P>Thanks. What is function of ssl_test.pl? I've renamed it so it won't run. Doesn't seem to affect the splunk server. Before disabling, about every three weeks, ssl_test.pl would spawn run-away processes and slow the server way down. I'd have to manually killall of the ssl_test.pl PIDs.</P> Mon, 28 Sep 2020 13:42:26 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcefire-estreamer-log-stopped-getting-data-after-Sourcefire/m-p/54758#M96855 johnwsrns 2020-09-28T13:42:26Z