All Apps and Add-ons

No PCAP data in estreamer_pcap.log

doogan
Engager

I was able to successfully install the latest Sourcefire app (2.0) into
my Splunk 4.3 environment. The app works for the most part but does not
log or index any pcap data.

I have pcap enabled in eStreamer (Intrusion Event Packet Data) in the
Sourcefire Defense Center and I have changed inputs.conf to read:

[script://$SPLUNK_HOME/etc/apps/Sourcefire/bin/estreamer_pcap.py]

disabled = false

interval = 0

source = estreamer_pcap.py

[monitor://$SPLUNK_HOME/etc/apps/Sourcefire/log/estreamer_pcap.log]

disabled = false

sourcetype = estreamer_pcap

I can see that estreamer_pcap.py is running every minute but
estreamer_pcap.log is always empty.

INFO ExecProcessor - Ran script: python
/usr/local/splunk/etc/apps/Sourcefire/bin/estreamer.py, took 79.97
milliseconds to run, 0 bytes read

I do see single packets getting written to /tmp/tmp.pcap and the
following command successfully produces pcap data:

./ssl_test_pcap.pl x.x.x.x -o splunk_pcap -tshark=/usr/sbin/tshark -f
test.pcap

However, I can't figure out why 'estreamer_pcap.log' is always empty.
Any help or suggestions would be greatly appreciated.

0 Karma

rbhatia
Explorer

Did you find a solution to this? I am facing the exact same issue.

0 Karma

rbhatia
Explorer

I was able to fix it. Was missing perl-XML-Parser perl module. Also, had to install tshark and updated inputs.conf file disabled=false for monitoring of estreamers_pcap.log

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...