All Apps and Add-ons

Error: read ECONNRESET

fredshino
Explorer

Connection reset looks like a networking issue to me but I checked our firewall logs and I don't see any denies on packets sent by our Splunk HF where the add-on is installed.

Can you give me any guidance on how to troubleshoot this?

02-25-2019 09:45:35.922 -0500 ERROR ExecProcessor - message from "/Data/splunk/etc/apps/TA-Azure_Monitor/bin/azure_activity_log.sh" Modular input azure_activity_log://***** Error getting event hub creds: RequestError: Error: read ECONNRESET
02-25-2019 09:46:35.855 -0500 ERROR ExecProcessor - message from "/Data/splunk/etc/apps/TA-Azure_Monitor/bin/azure_diagnostic_logs.sh" Modular input azure_diagnostic_logs://***** Diag Logs Error getting event hub creds: RequestError: Error: read ECONNRESET
0 Karma
1 Solution

fredshino
Explorer

I did. It was a firewall issue after all. I didn't see it in the firewall logs initially but after I talked to our networking team, they found some blocked packets going to the Key Vault. After we allowed those, we saw more traffic being blocked, now going to the Event Hub itself.

Basically, we had to add the following to the Firewall whitelist:

Dest: yourKeyVaultName.vault.azure.net
Service: TCP/443

Dest: yourEventhubName.servicebus.windows.net
Service: TCP/5671

View solution in original post

0 Karma

fredshino
Explorer

I did. It was a firewall issue after all. I didn't see it in the firewall logs initially but after I talked to our networking team, they found some blocked packets going to the Key Vault. After we allowed those, we saw more traffic being blocked, now going to the Event Hub itself.

Basically, we had to add the following to the Firewall whitelist:

Dest: yourKeyVaultName.vault.azure.net
Service: TCP/443

Dest: yourEventhubName.servicebus.windows.net
Service: TCP/5671

0 Karma

rmoss84
Explorer

Awesome. Looking at our traffic, we've got the same issue. Thank you for your answer. This should solve our problems as well.

0 Karma

rmoss84
Explorer

Did you find a solution to this? I'm receiving the same error on my instance.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...