How to resolve "tcp-rst-from-server" & "tcp-rst-from-client" errors?

[yossefn]

Hi, 

I'm trying to collect logs from a web servers, but getting an error on the FIrewall says "tcp-rst-from-server" on port 9997. Also, I have another error "tcp-rst-from-client" on port 8089.

I have to say that there are other servers in the same VLAN that I'm getting logs from. 

Where can I look to solve the problem?

[sbaror11]

Is it a question about Splunk or about the web servers? 

tcp reset from client or from servers is a layer-2 error which refers to an application layer related event

It can be described as "the client or server terminated the session but I don't know why"

You can look at the application (http/https) logs to see the reason. 

[yossefn]

Hi @sbaror11, 

The question is about Splunk - wondered if maybe Splunk denied somehow the connection, or I missed some configuration that preventing me from getting the logs. 

I had kind of issue with "aged-out" errors on the FW logs, then I figured out that the local FW on the Splunk servers denied the connection. 

[kgalibert]

Hi,

Do you have find your solution?

Have same issue between an UF on Windows server AD and an UF Relay.

Thans