All Apps and Add-ons

Enablng debug to troubleshoot proofpoint_tap_siem.py stream_events [Errno 111] Connection refused

staten
Observer

Hi, we've been successfully running this add-on on a heavy-forwarder (HF) for a while. The add-on connects to tap-api-v2.proofpoint.com every 10 minutes. Starting yesterday (Sunday), ProofPooint_TAP_SIEM logs stopped getting indexed. splunkd.log on our HF running this add-on reports an error.

We went from this:
12-02-2018 10:31:05.412 -0500 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/proofpoint_tap_siem.py" proofpoint_tap_siem://Proofpoint: query_and_save/Successful query from 2018-12-02T15:21:05Z to 2018-12-02T15:31:04Z

to this:
12-02-2018 10:41:04.836 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/proofpoint_tap_siem.py" proofpoint_tap_siem://Proofpoint: stream_events/[Errno 111] Connection refused

The firewall logs indicate that this HF is no longer connecting to the API server at this point. And this appears to be confirmed by running tcpdump on the HF, where we see no connection attempts to dst 148.163.148.173 or dst 148.163.152.173.

How can we enable debugging to troubleshoot this issue?

Thanks.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...