All Apps and Add-ons

Enablng debug to troubleshoot proofpoint_tap_siem.py stream_events [Errno 111] Connection refused

staten
Observer

Hi, we've been successfully running this add-on on a heavy-forwarder (HF) for a while. The add-on connects to tap-api-v2.proofpoint.com every 10 minutes. Starting yesterday (Sunday), ProofPooint_TAP_SIEM logs stopped getting indexed. splunkd.log on our HF running this add-on reports an error.

We went from this:
12-02-2018 10:31:05.412 -0500 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/proofpoint_tap_siem.py" proofpoint_tap_siem://Proofpoint: query_and_save/Successful query from 2018-12-02T15:21:05Z to 2018-12-02T15:31:04Z

to this:
12-02-2018 10:41:04.836 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/proofpoint_tap_siem.py" proofpoint_tap_siem://Proofpoint: stream_events/[Errno 111] Connection refused

The firewall logs indicate that this HF is no longer connecting to the API server at this point. And this appears to be confirmed by running tcpdump on the HF, where we see no connection attempts to dst 148.163.148.173 or dst 148.163.152.173.

How can we enable debugging to troubleshoot this issue?

Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...