Forwarder stopped forwarding after restart of server

[johnsmithman2]

I am using the VMware Syslog collector to collect the logs from my ESXi hosts and send them to Splunk with the universal forwarder. Everything was working great until I restarted the server with the Syslog collector and the universal forwarder today. The logs are no longer being forwarded or Splunk is not indexing the received messages, what could cause this?

I know it is not a problem with the VMware Syslog collector because the service is running fine and the logs are being updated from the ESXi hosts.

Any ideas on what causes this after a restart?

[idsiano]

In this thread it was explained that is a VMWare issue

[kreszan]

I have similar issue @ 6.0. Any resolution to this ?

[mrflibbleuk]

Did you get any resolution to this one? I have had a similar issue, when I restarted the main Splunk server the Heavy forwarders seem to be unable to communicate to the server. Looking at the forwarder event logs I am getting an 'eventType=connect_fail' everytime it attempts to connect.

Sometimes restarting the splunk forwarder makes it psring back into life.

[johnsmithman2]

Yes it is, I should have mentioned that also.

[Drainy]

Have you verified that the universal forwarder is also still running?