Getting Data In

Cisco ironport syslog broken pipe

Path Finder


I configured Splunk to handle TCP syslog from ironport appliances:

connection_host = dns
index = ironport
source = mailinfra
sourcetype = cisco:esa:textmail
queueSize = 10MB

but there is quite a lot of alerts on ironport side:

Log Error: Subscription mrelay_mail_logs: Network error while sending log data to syslog server ( [Errno 32] Broken pipe

Ironport sends the logs on a VIP which is forwarder to a pool of Splunk Heavy Forwarders.

I'm gonna check if mulitples TCP sessions can be optimized on the loadbalancer but is there any specific Splunk inputs.conf parameter I should check as well? thanks.

New Member

Same problem here ? May I know any solution that I can do ? thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...