Handshake and socket error

[drberg]

OS for forwarder: Windows Server 2012
Splunk + Universal Forwarder version: 6

I'm trying to get my Universal Forwarder to contact the deployment server. The only "change" I have done during the installation is setting the deployment server in the msiexec.exe.

C:\Program Files\SplunkUniversalForwarder\etc\system\local\deploymentclient.conf:

[target-broker:deploymentServer]
targetUri = server:port

C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log:

10-24-2013 15:46:00.722 +0200 INFO HttpPubSubConnection - Secure HTTP POST failed: Connect to=server:port timed out; exceeded 5sec
10-24-2013 15:46:00.722 +0200 INFO HttpPubSubConnection - Could not obtain connection, will retry after=56 seconds.
10-24-2013 15:46:08.584 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-24-2013 15:46:20.597 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-24-2013 15:46:32.609 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-24-2013 15:46:44.621 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-24-2013 15:46:56.634 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

Log from the Splunk server

10-24-2013 12:33:42.634 +0200 WARN HttpListener - Socket error from X.X.X.X while idling: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request

Just for clearity: I can not see my client trying to phone home in under Forwarder management.

Have I left out something important in my forwarder configuration? Some suggestions on what I'm doing wrong?

[drberg]

Maybe it's a firewall in the route to the deployment server?

[rameshlpatel]

Same issue i am facing , and i also checked all urls.

Please help me on this

[drberg · Accepted solution]

Well this is embarassing. Turns out I had the wrong url to the deployment server. It's all good now.