Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Error: read ECONNRESET
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Connection reset looks like a networking issue to me but I checked our firewall logs and I don't see any denies on packets sent by our Splunk HF where the add-on is installed.
Can you give me any guidance on how to troubleshoot this?
02-25-2019 09:45:35.922 -0500 ERROR ExecProcessor - message from "/Data/splunk/etc/apps/TA-Azure_Monitor/bin/azure_activity_log.sh" Modular input azure_activity_log://***** Error getting event hub creds: RequestError: Error: read ECONNRESET
02-25-2019 09:46:35.855 -0500 ERROR ExecProcessor - message from "/Data/splunk/etc/apps/TA-Azure_Monitor/bin/azure_diagnostic_logs.sh" Modular input azure_diagnostic_logs://***** Diag Logs Error getting event hub creds: RequestError: Error: read ECONNRESET
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I did. It was a firewall issue after all. I didn't see it in the firewall logs initially but after I talked to our networking team, they found some blocked packets going to the Key Vault. After we allowed those, we saw more traffic being blocked, now going to the Event Hub itself.
Basically, we had to add the following to the Firewall whitelist:
Dest: yourKeyVaultName.vault.azure.net
Service: TCP/443
Dest: yourEventhubName.servicebus.windows.net
Service: TCP/5671
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I did. It was a firewall issue after all. I didn't see it in the firewall logs initially but after I talked to our networking team, they found some blocked packets going to the Key Vault. After we allowed those, we saw more traffic being blocked, now going to the Event Hub itself.
Basically, we had to add the following to the Firewall whitelist:
Dest: yourKeyVaultName.vault.azure.net
Service: TCP/443
Dest: yourEventhubName.servicebus.windows.net
Service: TCP/5671
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Awesome. Looking at our traffic, we've got the same issue. Thank you for your answer. This should solve our problems as well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you find a solution to this? I'm receiving the same error on my instance.
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
Customer success is front and center at .conf25
