Getting Data In

Heavy forwarder with 2nics not communicating on 8089

nickstone
Path Finder

I have a heavy forwarder running 6.4.1 on CentOS 7 with 2 nics on seperate subnets (data and mgt) that won't communicate on port 8089.

In a netstat I can see that 8089 is listening but no comms.

When I disable one of the interface, everything works fine.

Any ideas?

0 Karma

ephemeric
Contributor

LOL! SELinux again.

grep "denied" /var/log/audit/audit.log
0 Karma

mtranchita
Communicator

Guessing that splunk is confused about what IP it should be using. I would try setting the IP for interface that you want use by setting SPLUNK_BINDIP= in the splunk-launch.conf.
Note that this conf file is not in apps but rather $SPLUNK_HOME/etc/splunk-launch.conf.
Double check the spec, http://docs.splunk.com/Documentation/Splunk/latest/Admin/Splunk-launchconf, for syntax.
Hope this helps!

0 Karma

nickstone
Path Finder

this will bind both 8089, 9997 AND web to that interface right? Web needs to be separated to mgt and not on data otherwise it defeats the purpose of segmentaton

0 Karma

mtranchita
Communicator

right, sorry.
Have you tried setting mgmtHostPort in web.conf?

0 Karma

nickstone
Path Finder

mgmtHostPort is set to localhost on port 8089

0 Karma

nickstone
Path Finder

never mind SElinux,....

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...