Installing Splunk Universal Forwarder - Error

[mchopra]

Hi
I have installed Splunk Universal Forwarder to send messages to an indexer (version 5.0.1). The messages are being sent, but we see the following errors in our log files.

Forwarder Logs
10-18-2016 11:16:40.000 +1100 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-18-2016 11:16:43.850 +1100 WARN HttpPubSubConnection - HTTP client error in http pubsub Connection closed by peer uri=http://10.90.XX.XXX:8087/services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087/XXXXXXXX/b0310...
10-18-2016 11:16:43.850 +1100 WARN HttpPubSubConnection - Unable to parse message from PubSubSvr:
10-18-2016 11:16:43.850 +1100 INFO HttpPubSubConnection - Could not obtain connection, will retry after=81.907 seconds.
10-18-2016 11:16:52.001 +1100 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

Server Logs

10-18-2016 11:04:23.854 +1100 ERROR TcpInputProc - Received unrecognized signature POST /services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087/XXXXXXX/b03109c2bad4/aix-power/8089/6.4.0/E83BB6F5-448D-491D-8F9E-D497760D6087/universal_forwarder/XXXXXXX HTTP/1.1\r\nUser-Agent: Splunk/6.4.3 (AIX 6.1; arch=4C)\r\nTE: trailers, chunked\r\nHost: 10.90.16.165:8087\r\nContent-Length: 0\r\nx-splunk-lm-nonce: b68e75b9f1d802a8be9da54499c6edd5\r\nx-splunk-lm-timestamp: 1476749063\r\nx-splunk-l! from src=10.3.1.46:52227

Thanks
Manish

[ddrillic]

A similar issue at Handshaking issue with deployment server

[mchopra]

This issue is different as the client machine can connect to the server machine. I have tested that as under

wget -p http://10.90.XX.XXX:8087/services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087/
--08:58:03-- http://10.90.XX.XXX5:8087/services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087/
=> `10.90.XX.XXX:8087/services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087/index.html'
Connecting to 10.90.XX.XXX5:8087... connected.
HTTP request sent, awaiting response...

Also I can see the server logs with the error as posted above
ERROR TcpInputProc - Received unrecognized signature POST /services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087...........