topic Re: Large number of errors processing data from forwarders over SSL in Monitoring Splunk https://community.splunk.com/t5/Monitoring-Splunk/Large-number-of-errors-processing-data-from-forwarders-over-SSL/m-p/81172#M7287 <P>Unfortunately this is a bug and we are trying to identify root cause. </P> Mon, 18 Apr 2011 05:58:11 GMT jkerai 2011-04-18T05:58:11Z Large number of errors processing data from forwarders over SSL https://community.splunk.com/t5/Monitoring-Splunk/Large-number-of-errors-processing-data-from-forwarders-over-SSL/m-p/81171#M7286 <P>The data is being indexed, but a lot of errors in splunkd.log</P> <P>this is a snippet of log after running splunk indexer in debug mode:</P> <PRE><CODE>04-13-2011 15:54:08.135 ERROR TcpInputProc - Error encountered for connection from src=xxx.xxx.xxx.xxx:2744. Success 04-13-2011 15:54:08.135 DEBUG StatusMgr - Updating status for TcpInputProcessor 04-13-2011 15:54:08.135 INFO StatusMgr - destPort=9992, eventType=connect_close, sourceHost=xxx.xxx.xxx.xxx, sourceIp=xxx.xxx.xxx.xxx, sourcePort=2744, statusee= TcpInputProcessor 04-13-2011 15:54:08.135 ERROR TcpInputProc - Error encountered for connection from src=xxx.xxx.xxx.xxx:3473. Success 04-13-2011 15:54:08.135 DEBUG StatusMgr - Updating status for TcpInputProcessor 04-13-2011 15:54:08.135 INFO StatusMgr - destPort=9992, eventType=connect_close, sourceHost=xxx.xxx.xxx.xxx, sourceIp=xxx.xxx.xxx.xxx, sourcePort=3473, statusee= TcpInputProcessor 04-13-2011 15:54:08.342 DEBUG StatusMgr - Updating status for TcpInputProcessor 04-13-2011 15:54:08.342 INFO StatusMgr - destPort=9997, eventType=connect_close, sourceHost=xxx.xxx.xxx.xxx, sourceIp=xxx.xxx.xxx.xxx, sourcePort=61588, statusee=T cpInputProcessor 04-13-2011 15:54:08.399 DEBUG StatusMgr - Updating status for TcpInputProcessor 04-13-2011 15:54:08.553 ERROR TcpInputProc - Error encountered for connection from src=xxx.xxx.xxx.xxx:2575. Success 04-13-2011 15:54:08.553 DEBUG StatusMgr - Updating status for TcpInputProcessor 04-13-2011 15:54:08.553 INFO StatusMgr - destPort=9992, eventType=connect_close, sourceHost=xxx.xxx.xxx.xxx, sourceIp=xxx.xxx.xxx.xxx, sourcePort=2575, statusee= TcpInputProcessor </CODE></PRE> <P>Thank you, Ildus </P> Thu, 14 Apr 2011 03:28:44 GMT https://community.splunk.com/t5/Monitoring-Splunk/Large-number-of-errors-processing-data-from-forwarders-over-SSL/m-p/81171#M7286 nurtdi 2011-04-14T03:28:44Z Re: Large number of errors processing data from forwarders over SSL https://community.splunk.com/t5/Monitoring-Splunk/Large-number-of-errors-processing-data-from-forwarders-over-SSL/m-p/81172#M7287 <P>Unfortunately this is a bug and we are trying to identify root cause. </P> Mon, 18 Apr 2011 05:58:11 GMT https://community.splunk.com/t5/Monitoring-Splunk/Large-number-of-errors-processing-data-from-forwarders-over-SSL/m-p/81172#M7287 jkerai 2011-04-18T05:58:11Z Re: Large number of errors processing data from forwarders over SSL https://community.splunk.com/t5/Monitoring-Splunk/Large-number-of-errors-processing-data-from-forwarders-over-SSL/m-p/81173#M7288 <P>Any update?</P> Wed, 04 May 2011 23:17:31 GMT https://community.splunk.com/t5/Monitoring-Splunk/Large-number-of-errors-processing-data-from-forwarders-over-SSL/m-p/81173#M7288 Jeremiah 2011-05-04T23:17:31Z