Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Heavy forwarder with 2nics not communicating on 80...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Heavy forwarder with 2nics not communicating on 8089
I have a heavy forwarder running 6.4.1 on CentOS 7 with 2 nics on seperate subnets (data and mgt) that won't communicate on port 8089.
In a netstat I can see that 8089 is listening but no comms.
When I disable one of the interface, everything works fine.
Any ideas?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
LOL! SELinux again.
grep "denied" /var/log/audit/audit.log- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Guessing that splunk is confused about what IP it should be using. I would try setting the IP for interface that you want use by setting SPLUNK_BINDIP= in the splunk-launch.conf.
Note that this conf file is not in apps but rather $SPLUNK_HOME/etc/splunk-launch.conf.
Double check the spec, http://docs.splunk.com/Documentation/Splunk/latest/Admin/Splunk-launchconf, for syntax.
Hope this helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this will bind both 8089, 9997 AND web to that interface right? Web needs to be separated to mgt and not on data otherwise it defeats the purpose of segmentaton
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
right, sorry.
Have you tried setting mgmtHostPort in web.conf?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
mgmtHostPort is set to localhost on port 8089
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
never mind SElinux,....
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
