All Apps and Add-ons

Enablng debug to troubleshoot proofpoint_tap_siem.py stream_events [Errno 111] Connection refused

Observer

Hi, we've been successfully running this add-on on a heavy-forwarder (HF) for a while. The add-on connects to tap-api-v2.proofpoint.com every 10 minutes. Starting yesterday (Sunday), ProofPoointTAPSIEM logs stopped getting indexed. splunkd.log on our HF running this add-on reports an error.

We went from this:
12-02-2018 10:31:05.412 -0500 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/proofpointtapsiem.py" proofpointtapsiem://Proofpoint: queryandsave/Successful query from 2018-12-02T15:21:05Z to 2018-12-02T15:31:04Z

to this:
12-02-2018 10:41:04.836 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/proofpointtapsiem.py" proofpointtapsiem://Proofpoint: stream_events/[Errno 111] Connection refused

The firewall logs indicate that this HF is no longer connecting to the API server at this point. And this appears to be confirmed by running tcpdump on the HF, where we see no connection attempts to dst 148.163.148.173 or dst 148.163.152.173.

How can we enable debugging to troubleshoot this issue?

Thanks.

0 Karma