App : Splunk Add-on for F5 BIG-IP
I already configured F5 LTM and currently its forwarding syslog to my splunk. But., in
Configure the modular inputs for the Splunk Add-on for F5 BIG-IP
after I configure the Server, templates, tasks - I didn't receive any data from the F5 servers. When i dig into the logs , I get this error message. Can someone please help how to resolve this ?
Error logs:
Location : source="/opt/splunk/var/log/splunk/Splunk_TA_f5_bigip_main.log"
2016-01-22 07:33:31,055 ERROR pid=23801 tid=Thread-17 file=F5_iControl_Template.py:_fetch:92 | Fail to set active folder as partition "/Common" for Template "call LocalLB.VirtualAddressV2.get_list against LocalLB.VirtualAddressV2.get_address;get_connection_limit;get_enabled_state;get_object_status;get_status_dependency_scope;get_traffic_group interval 60" on F5 BIGIP "http://10.x.x.x"
Are you using FIPS cryto modules on the server where the modular inputs are running?
Modular inputs are running on the splunk enterprise 6.3.2. this server is a new vm, and I referred to the page
https://answers.splunk.com/answers/10588/does-splunk-support-fips-140-2.html
, my server is running with default configs & modules.
I was getting the same error because we had fips enabled on the server. After disabling fips and rebooting the box the issue was fixed.
check your /etc/grub.conf and make sure fips attribute is set to 0
Are you on the most recent version? Early versions assumed a single partition and IIRC there was an error like that.
Yes , I using the latest splunk & add-on for F5 BIG-IP