Stream: 10G capture using Intel x520 on linux help?

[jeff]

Anyone out there doing 10G with Splunk Stream on RHEL (or linux) utilizing an Intel x520?

We're attempting to configure a dedicated Stream capture server on RHEL7 with 2x 1GB copper nics bonded and bound to TCP, and the x520 is designed to be a dedicated out of band monitoring card. The optical link is connected to Gigamon. We've validated the link is active and sending data through the transceiver by plugging it into a fluke.

Problem 1: RHEL isn't recognizing the link:

Settings for eth6:
        Supported ports: [ FIBRE ]
        Supported link modes:   10000baseT/Full
        Supported pause frame use: No
        Supports auto-negotiation: No
        Advertised link modes:  10000baseT/Full
        Advertised pause frame use: No
        Advertised auto-negotiation: No
        Speed: Unknown!
        Duplex: Unknown! (255)
        Port: Other
        PHYAD: 0
        Transceiver: external
        Auto-negotiation: off
        Supports Wake-on: umbg
        Wake-on: g
        Current message level: 0x00000007 (7)
                               drv probe link
        Link detected: no

Problem 2: I have configured Splunk for dedicated capture as described in the documentation.

> cat streamfwd.conf
[streamfwd]
dedicatedCaptureMode = 1
streamfwdcapture.0.interface=0000:01:00.0

When Splunk starts, RHEL drops the entire network stack (the servers go offline):

Jun 23 11:16:17 sp-strm-01 kernel: Generic UIO driver for PCI 2.3 devices version: 0.01.0
Jun 23 11:16:17 sp-strm-01 kernel: ixgbe 0000:01:00.0: removed PHC on em1
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:06:00.0: removed PHC on em3
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:06:00.1: removed PHC on em4
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:81:00.0: removed PHC on p1p1
Jun 23 11:16:17 sp-strm-01 kernel: bond0: Releasing active interface p1p1
Jun 23 11:16:17 sp-strm-01 kernel: bond0: the permanent HWaddr of p1p1 - a0:36:9f:e5:9b:78 - is still in use by bond0 - set the HWaddr of p1p1 to a different address to avoid conflicts
Jun 23 11:16:17 sp-strm-01 kernel: bond0: making interface p1p2 the new active one
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:81:00.1: removed PHC on p1p2
Jun 23 11:16:17 sp-strm-01 kernel: bond0: Releasing active interface p1p2
Jun 23 11:16:17 sp-strm-01 kernel: igb 0000:81:00.2: removed PHC on p1p3
Jun 23 11:16:18 sp-strm-01 kernel: igb 0000:81:00.3: removed PHC on p1p4

Would appreciate any guidance y'all might have...

[jeff · Accepted solution]

Solution to Problem 1: the Intel x520 has a very narrow set of supported 10G SPF+ transceivers . We swapped out with the appropriate module and the link is now recognized.

Solution to Problem 2: A bug (STREAM-3651) existed in Stream 7.1.0 and resolved in 7.1.1.