All Apps and Add-ons

Splunk App for Stream: Why am I getting "SnifferReactor failed to open pcap adapter for device...connection refused" in stream:log?

New Member

I have streamfwd "running" on OSX

I see the following errors in the Splunk interface when I run the search
index=_internal sourcetype="stream:log"

SnifferReactor failed to open pcap adapter for device <en1>. Error message:  
Unable to ping server (591fb575-3b32-421a-956f-2f3b512ecda9): Unable to establish connection to localhost: Connection refused

Splunk is running as a privileged user (started splunk using sudo) and setuid.sh has been run in SplunkTAstream directory.

any ideas?

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Are you planning to capture the en1 interface or is it just getting picked up by default configuration? Stream Forwarder by default starts captures on all en* and lo* interfaces. There's a known issue (will be fixed in the next version) with starting stream forwarder if starting the data capture on one of these interfaces fails. As a workaround, you can specify the actual interface you want to capture the data by using the config parameter in streamfwd.xml config file - http://docs.splunk.com/Documentation/StreamApp/6.3.2/DeployStreamApp/ConfigureStreamForwarder#Use_XM...

View solution in original post

Path Finder

Hello,

I've the same issue, i'm running the 7.0.1 and i've specified one interface but i still get the error 😕
Any ideas ?

Regards !

0 Karma

Splunk Employee
Splunk Employee

Do you have sufficient permissions? On Mac/linux, you need to run set_permissions.sh script as sudo before starting stream forwarder.

0 Karma

Splunk Employee
Splunk Employee

Are you planning to capture the en1 interface or is it just getting picked up by default configuration? Stream Forwarder by default starts captures on all en* and lo* interfaces. There's a known issue (will be fixed in the next version) with starting stream forwarder if starting the data capture on one of these interfaces fails. As a workaround, you can specify the actual interface you want to capture the data by using the config parameter in streamfwd.xml config file - http://docs.splunk.com/Documentation/StreamApp/6.3.2/DeployStreamApp/ConfigureStreamForwarder#Use_XM...

View solution in original post

New Member

I meant now collecting data 🙂

0 Karma

New Member

great thanks.

no collecting data.

0 Karma