Anyone out there doing 10G with Splunk Stream on RHEL (or linux) utilizing an Intel x520?
We're attempting to configure a dedicated Stream capture server on RHEL7 with 2x 1GB copper nics bonded and bound to TCP, and the x520 is designed to be a dedicated out of band monitoring card. The optical link is connected to Gigamon. We've validated the link is active and sending data through the transceiver by plugging it into a fluke.
Problem 1: RHEL isn't recognizing the link:
Settings for eth6:
Supported ports: [ FIBRE ]
Supported link modes: 10000baseT/Full
Supported pause frame use: No
Supports auto-negotiation: No
Advertised link modes: 10000baseT/Full
Advertised pause frame use: No
Advertised auto-negotiation: No
Speed: Unknown!
Duplex: Unknown! (255)
Port: Other
PHYAD: 0
Transceiver: external
Auto-negotiation: off
Supports Wake-on: umbg
Wake-on: g
Current message level: 0x00000007 (7)
drv probe link
Link detected: no
Problem 2: I have configured Splunk for dedicated capture as described in the documentation.
> cat streamfwd.conf
[streamfwd]
dedicatedCaptureMode = 1
streamfwdcapture.0.interface=0000:01:00.0
When Splunk starts, RHEL drops the entire network stack (the servers go offline):
Jun 23 11:16:17 sp-strm-01 kernel: Generic UIO driver for PCI 2.3 devices version: 0.01.0
Jun 23 11:16:17 sp-strm-01 kernel: ixgbe 0000:01:00.0: removed PHC on em1
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:06:00.0: removed PHC on em3
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:06:00.1: removed PHC on em4
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:81:00.0: removed PHC on p1p1
Jun 23 11:16:17 sp-strm-01 kernel: bond0: Releasing active interface p1p1
Jun 23 11:16:17 sp-strm-01 kernel: bond0: the permanent HWaddr of p1p1 - a0:36:9f:e5:9b:78 - is still in use by bond0 - set the HWaddr of p1p1 to a different address to avoid conflicts
Jun 23 11:16:17 sp-strm-01 kernel: bond0: making interface p1p2 the new active one
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:81:00.1: removed PHC on p1p2
Jun 23 11:16:17 sp-strm-01 kernel: bond0: Releasing active interface p1p2
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:81:00.2: removed PHC on p1p3
Jun 23 11:16:18 sp-strm-01 kernel: igb 0000:81:00.3: removed PHC on p1p4
Would appreciate any guidance y'all might have...
Solution to Problem 1: the Intel x520 has a very narrow set of supported 10G SPF+ transceivers . We swapped out with the appropriate module and the link is now recognized.
Solution to Problem 2: A bug (STREAM-3651) existed in Stream 7.1.0 and resolved in 7.1.1.
Solution to Problem 1: the Intel x520 has a very narrow set of supported 10G SPF+ transceivers . We swapped out with the appropriate module and the link is now recognized.
Solution to Problem 2: A bug (STREAM-3651) existed in Stream 7.1.0 and resolved in 7.1.1.