Heavy forwarder with 2nics not communicating on 8089

[nickstone]

I have a heavy forwarder running 6.4.1 on CentOS 7 with 2 nics on seperate subnets (data and mgt) that won't communicate on port 8089.

In a netstat I can see that 8089 is listening but no comms.

When I disable one of the interface, everything works fine.

Any ideas?

[ephemeric]

LOL! SELinux again.

grep "denied" /var/log/audit/audit.log

[mtranchita]

Guessing that splunk is confused about what IP it should be using. I would try setting the IP for interface that you want use by setting SPLUNK_BINDIP= in the splunk-launch.conf.
Note that this conf file is not in apps but rather $SPLUNK_HOME/etc/splunk-launch.conf.
Double check the spec, http://docs.splunk.com/Documentation/Splunk/latest/Admin/Splunk-launchconf, for syntax.
Hope this helps!

[nickstone]

this will bind both 8089, 9997 AND web to that interface right? Web needs to be separated to mgt and not on data otherwise it defeats the purpose of segmentaton

[mtranchita]

right, sorry.
Have you tried setting mgmtHostPort in web.conf?

[nickstone]

mgmtHostPort is set to localhost on port 8089

[nickstone]

never mind SElinux,....