Splunk App for Stream: Why am I getting "SnifferReactor failed to open pcap adapter for device...connection refused" in stream:log?

[nc1138]

I have streamfwd "running" on OSX

I see the following errors in the Splunk interface when I run the search
index=_internal sourcetype="stream:log"

SnifferReactor failed to open pcap adapter for device <en1>. Error message:  
Unable to ping server (591fb575-3b32-421a-956f-2f3b512ecda9): Unable to establish connection to localhost: Connection refused

Splunk is running as a privileged user (started splunk using sudo) and setuid.sh has been run in Splunk_TA_stream directory.

any ideas?

[vince2010091]

Hello,

I've the same issue, i'm running the 7.0.1 and i've specified one interface but i still get the error 😕
Any ideas ?

Regards !

[vshcherbakov_sp]

Do you have sufficient permissions? On Mac/linux, you need to run set_permissions.sh script as sudo before starting stream forwarder.

[vshcherbakov_sp · Accepted solution]

Are you planning to capture the en1 interface or is it just getting picked up by default configuration? Stream Forwarder by default starts captures on all en* and lo* interfaces. There's a known issue (will be fixed in the next version) with starting stream forwarder if starting the data capture on one of these interfaces fails. As a workaround, you can specify the actual interface you want to capture the data by using the config parameter in streamfwd.xml config file - http://docs.splunk.com/Documentation/StreamApp/6.3.2/DeployStreamApp/ConfigureStreamForwarder#Use_XM...

[nc1138]

I meant now collecting data 🙂

[nc1138]

great thanks.

no collecting data.