All Apps and Add-ons

Stream: 10G capture using Intel x520 on linux help?

jeff
Contributor

Anyone out there doing 10G with Splunk Stream on RHEL (or linux) utilizing an Intel x520?

We're attempting to configure a dedicated Stream capture server on RHEL7 with 2x 1GB copper nics bonded and bound to TCP, and the x520 is designed to be a dedicated out of band monitoring card. The optical link is connected to Gigamon. We've validated the link is active and sending data through the transceiver by plugging it into a fluke.

Problem 1: RHEL isn't recognizing the link:

Settings for eth6:
        Supported ports: [ FIBRE ]
        Supported link modes:   10000baseT/Full
        Supported pause frame use: No
        Supports auto-negotiation: No
        Advertised link modes:  10000baseT/Full
        Advertised pause frame use: No
        Advertised auto-negotiation: No
        Speed: Unknown!
        Duplex: Unknown! (255)
        Port: Other
        PHYAD: 0
        Transceiver: external
        Auto-negotiation: off
        Supports Wake-on: umbg
        Wake-on: g
        Current message level: 0x00000007 (7)
                               drv probe link
        Link detected: no

Problem 2: I have configured Splunk for dedicated capture as described in the documentation.

> cat streamfwd.conf
[streamfwd]
dedicatedCaptureMode = 1
streamfwdcapture.0.interface=0000:01:00.0

When Splunk starts, RHEL drops the entire network stack (the servers go offline):

Jun 23 11:16:17 sp-strm-01 kernel: Generic UIO driver for PCI 2.3 devices version: 0.01.0
Jun 23 11:16:17 sp-strm-01 kernel: ixgbe 0000:01:00.0: removed PHC on em1
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:06:00.0: removed PHC on em3
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:06:00.1: removed PHC on em4
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:81:00.0: removed PHC on p1p1
Jun 23 11:16:17 sp-strm-01 kernel: bond0: Releasing active interface p1p1
Jun 23 11:16:17 sp-strm-01 kernel: bond0: the permanent HWaddr of p1p1 - a0:36:9f:e5:9b:78 - is still in use by bond0 - set the HWaddr of p1p1 to a different address to avoid conflicts
Jun 23 11:16:17 sp-strm-01 kernel: bond0: making interface p1p2 the new active one
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:81:00.1: removed PHC on p1p2
Jun 23 11:16:17 sp-strm-01 kernel: bond0: Releasing active interface p1p2
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:81:00.2: removed PHC on p1p3
Jun 23 11:16:18 sp-strm-01 kernel: igb 0000:81:00.3: removed PHC on p1p4

Would appreciate any guidance y'all might have...

Tags (2)
1 Solution

jeff
Contributor

Solution to Problem 1: the Intel x520 has a very narrow set of supported 10G SPF+ transceivers . We swapped out with the appropriate module and the link is now recognized.

Solution to Problem 2: A bug (STREAM-3651) existed in Stream 7.1.0 and resolved in 7.1.1.

View solution in original post

0 Karma

jeff
Contributor

Solution to Problem 1: the Intel x520 has a very narrow set of supported 10G SPF+ transceivers . We swapped out with the appropriate module and the link is now recognized.

Solution to Problem 2: A bug (STREAM-3651) existed in Stream 7.1.0 and resolved in 7.1.1.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...