we have issue with splunk sourcefire connector , i couldn't get the exact error causing the failure but noticed this in /$splunk_home/etc/apps/sourcefire/bin , estreamer_debug.log
[splunk@splunkheavyforwarder bin]$ cat estreamer_debug.log
Jan 04 07:55:38 [51813] Effective Config: $VAR1 = {
'verbose' => '1',
'test' => undef,
'log_extra_data' => '1',
'log_metadata' => '1',
'domain' => 2,
'watch' => '1',
'pkcs12_password' => 'XXXXXX',
'server' => 'xx.xx.xx.xx',
'daemon' => 1,
'log_users' => 0,
'logfile' => '/opt/splunk/etc/apps/HSY-IA-sourcefire/log/estreamer.log ',
'ipv6' => undef,
'port' => 8302,
'log_flows' => 0,
'pkcs12_file' => '/opt/splunk/etc/apps/HSY-IA-sourcefire/local/10.140. 42.24.pkcs12',
'config' => '/$splunk_home/etc/apps/sourcefire/local/estreamer.conf',
'log_packets' => 0,
'start' => 'bookmark'
};
Jan 04 07:55:39 [51813] Setting up auth certificate
SFPkcs12 : Processing /$splunk_home/etc/apps/sourcefire/local/xx.xx.xx.xx.pkcs12
SFPkcs12 : Writing ./server.crt
SFPkcs12 : Writing ./server.key
Jan 04 07:55:39 [51813] Retrieving metadata from file ./metadata.dat
Jan 04 07:55:39 [51813] Migrating prior version bookmark (if necessary)
Jan 04 07:55:39 [51813] Starting processing for other
Jan 04 07:55:39 [51813] Building connection parameters for all other events
Jan 04 07:55:39 [51813] Connecting to xx.xx.xx.xx port 8302
Can't connect to xx.xx.xx.xx port 8302: Failed to open Private Keyerror:0906D 066:PEM routines:PEM_read_bio:bad end line
this is the error we are encountering ,help us in fixing the issue .
