Cisco IPS Add-On fails to pull events after the first query

[notyourmrr]

I have 3 sensors, 2 of which are remote. I installed and configured the IPS add-on and it will successfully retrieve events from all of the sensors. The problem is, after that first event query, it does not retrieve any more events from the remote sensors until I restart splunk (or perhaps the IPS add-on; I'm new to all of this.)

Is there some way to increase the time between queries? As I understand the interval= setting, 1 should automatically retry 1 second after the previous query exits.

I can't tell if that means "successfully exits."

When I check the logs for SDEE errors I'm seeing "connection reset by peer" errors, which due to the nature of the circuit I am unlikely to be able to change, but I would still think at some point the splunk add-on would just keep trying and that does not seem to be the case.

Any help would be greatly appreciated.

[Will_Hayes]

In the event of a connection exception or network interruption the SDEE script will sleep for 5 minutes before exiting. Once the process exits, Splunk will re-launch per the interval setting in inputs.conf. The reason for this is to prevent us from hammering the sensor in the case of a connection issue. That behavior is controlled on line 54 of the script:

    time.sleep(300)

You could edit that to a smaller number or even 1 if you'd like to retry immediately when the "connection reset by peer" occurs.

[notyourmrr]

Assuming you mean pySDEE.py, I cannot find that entry. I've also grep'ed for it in the other scripts, but cannot find that entry.