Timeouts for eStreamer Add-on

[cameronjust]

Hi All,

We have set this addon up following the documentation listed at

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreSpl...

and we are seeing these logs which appear to start the estreamer listener/collector which tries one call then times out and stops. Logs in reverse order of time (apologies)

status_id=0 status="Stopped"
2020-05-08 15:20:44,949 Controller   INFO     Goodbye
2020-05-08 15:20:44,949 Monitor      INFO     Stopping Monitor.
2020-05-08 15:20:44,949 Controller   INFO     Stopping...
2020-05-08 15:20:44,948 Controller   ERROR    TimeoutException: Connection read timeout\nTraceback (most recent call last):\n  File "/data/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/controller.py", line 244, in start\n    diagnostics.execute()\n  File "/data/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/diagnostics.py", line 96, in execute\n    response = connection.response()\n  File "/data/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/connection.py", line 182, in response\n    dataBuffer = self.__read( 8 )\n  File "/data/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/connection.py", line 173, in __read\n    raise estreamer.TimeoutException('Connection read timeout')\nTimeoutException: Connection read timeout\n
2020-05-08 15:20:42,947 Diagnostics  INFO     Receiving response message
2020-05-08 15:20:42,947 Diagnostics  INFO     Sending request message
2020-05-08 15:20:42,947 Diagnostics  INFO     Request message=000100***********061
2020-05-08 15:20:42,947 Diagnostics  INFO     Creating request message
2020-05-08 15:20:42,931 Connection   INFO     Using TLS v1.2
2020-05-08 15:20:42,931 Connection   INFO     Connecting to ******estreamer_host_redacted***.net:8302
2020-05-08 15:20:42,931 Diagnostics  INFO     Creating connection
2020-05-08 15:20:42,931 Diagnostics  INFO     Check certificate
2020-05-08 15:20:42,931 Controller   INFO     Settings: *************REDACTED***************
2020-05-08 15:20:42,931 Controller   INFO     Processes: 4
2020-05-08 15:20:42,931 Controller   INFO     Sha256: 38ad0dced0f*****REDACTED******f95bb887692f56b
2020-05-08 15:20:42,931 Controller   INFO     Platform version: Linux-3.10.0-1062.12.1.el7.x86_64-x86_64-with-centos-7.7.1908-Core
2020-05-08 15:20:42,931 Controller   INFO     Starting client (pid=23050).
2020-05-08 15:20:42,925 Controller   INFO     eNcore version: 3.6.8

We have checked that the firewall is not blocking port 8302 on the host.

The certificate entered on the setup screen appears to pass OK.

We even tried increasing the timeouts in TA-estreamer\bin\encore\default.conf

Any other tips of things we might be missing?

I thought we could ask here first before digging too deeply into the Python script to see why it's failing.

Thanks

[cameronjust · Accepted solution]

Update to this. The admins didn't setup the certificate correctly and didn't assign it the right IP address.

We only discovered this when we added TRACE debugging in the config file located in

TA-eStreamer/bin/encore/default.conf

Not sure why it wasn't detected as the code is there to detect that error in the Python code.