All Apps and Add-ons

Enablng debug to troubleshoot stream_events [Errno 111] Connection refused


Hi, we've been successfully running this add-on on a heavy-forwarder (HF) for a while. The add-on connects to every 10 minutes. Starting yesterday (Sunday), ProofPooint_TAP_SIEM logs stopped getting indexed. splunkd.log on our HF running this add-on reports an error.

We went from this:
12-02-2018 10:31:05.412 -0500 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/" proofpoint_tap_siem://Proofpoint: query_and_save/Successful query from 2018-12-02T15:21:05Z to 2018-12-02T15:31:04Z

to this:
12-02-2018 10:41:04.836 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/" proofpoint_tap_siem://Proofpoint: stream_events/[Errno 111] Connection refused

The firewall logs indicate that this HF is no longer connecting to the API server at this point. And this appears to be confirmed by running tcpdump on the HF, where we see no connection attempts to dst or dst

How can we enable debugging to troubleshoot this issue?


0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!