All Apps and Add-ons

Unable to poll F5 servers from splunk for logs - Error : Fail to set active folder as partition "/Common" for Template

Motivator

App : Splunk Add-on for F5 BIG-IP

I already configured F5 LTM and currently its forwarding syslog to my splunk. But., in

Configure the modular inputs for the Splunk Add-on for F5 BIG-IP

after I configure the Server, templates, tasks - I didn't receive any data from the F5 servers. When i dig into the logs , I get this error message. Can someone please help how to resolve this ?

Error logs:
Location : source="/opt/splunk/var/log/splunk/SplunkTAf5bigipmain.log"

2016-01-22 07:33:31,055 ERROR pid=23801 tid=Thread-17 file=F5_iControl_Template.py:_fetch:92 | Fail to set active folder as partition "/Common" for Template "call LocalLB.VirtualAddressV2.get_list against LocalLB.VirtualAddressV2.get_address;get_connection_limit;get_enabled_state;get_object_status;get_status_dependency_scope;get_traffic_group interval 60" on F5 BIGIP "http://10.x.x.x"
0 Karma

Explorer

Are you using FIPS cryto modules on the server where the modular inputs are running?

0 Karma

Motivator

Modular inputs are running on the splunk enterprise 6.3.2. this server is a new vm, and I referred to the page

https://answers.splunk.com/answers/10588/does-splunk-support-fips-140-2.html

, my server is running with default configs & modules.

0 Karma

Explorer

I was getting the same error because we had fips enabled on the server. After disabling fips and rebooting the box the issue was fixed.

check your /etc/grub.conf and make sure fips attribute is set to 0

0 Karma

Splunk Employee
Splunk Employee

Are you on the most recent version? Early versions assumed a single partition and IIRC there was an error like that.

0 Karma

Motivator

Yes , I using the latest splunk & add-on for F5 BIG-IP

0 Karma