I have a heavy forwarder running 6.4.1 on CentOS 7 with 2 nics on seperate subnets (data and mgt) that won't communicate on port 8089.
In a netstat I can see that 8089 is listening but no comms.
When I disable one of the interface, everything works fine.
Any ideas?
LOL! SELinux again.
grep "denied" /var/log/audit/audit.log
Guessing that splunk is confused about what IP it should be using. I would try setting the IP for interface that you want use by setting SPLUNK_BINDIP= in the splunk-launch.conf.
Note that this conf file is not in apps but rather $SPLUNK_HOME/etc/splunk-launch.conf.
Double check the spec, http://docs.splunk.com/Documentation/Splunk/latest/Admin/Splunk-launchconf, for syntax.
Hope this helps!
this will bind both 8089, 9997 AND web to that interface right? Web needs to be separated to mgt and not on data otherwise it defeats the purpose of segmentaton
right, sorry.
Have you tried setting mgmtHostPort in web.conf?
mgmtHostPort is set to localhost on port 8089
never mind SElinux,....