I'm trying to collect logs from a web servers, but getting an error on the FIrewall says "tcp-rst-from-server" on port 9997. Also, I have another error "tcp-rst-from-client" on port 8089.
I have to say that there are other servers in the same VLAN that I'm getting logs from.
Where can I look to solve the problem?
Is it a question about Splunk or about the web servers?
tcp reset from client or from servers is a layer-2 error which refers to an application layer related event
It can be described as "the client or server terminated the session but I don't know why"
You can look at the application (http/https) logs to see the reason.
The question is about Splunk - wondered if maybe Splunk denied somehow the connection, or I missed some configuration that preventing me from getting the logs.
I had kind of issue with "aged-out" errors on the FW logs, then I figured out that the local FW on the Splunk servers denied the connection.