Getting Data In

Sourcefire estreamer.log stopped getting data after Sourcefire update

johnwsrns
New Member

No data in estreamer.log after Sourcefire update. SSL test shows connection to Sourcefire server is up. I've restarted splunkd but still no data. Any suggestions?

0 Karma
1 Solution

agrachevBLK
Explorer

Had a similar situation: estream stopped flowing after a network outage that took the SDC-splunk link down...

Ended up manually removing pid files in apps/Sourcefire/tmp ; archiving logs in ../log

However, most likely, it's the bookmark reset (./ssl_test.pl -start=now ) that helped...

View solution in original post

0 Karma

agrachevBLK
Explorer

Had a similar situation: estream stopped flowing after a network outage that took the SDC-splunk link down...

Ended up manually removing pid files in apps/Sourcefire/tmp ; archiving logs in ../log

However, most likely, it's the bookmark reset (./ssl_test.pl -start=now ) that helped...

0 Karma

johnwsrns
New Member

Thanks. What is function of ssl_test.pl? I've renamed it so it won't run. Doesn't seem to affect the splunk server. Before disabling, about every three weeks, ssl_test.pl would spawn run-away processes and slow the server way down. I'd have to manually killall of the ssl_test.pl PIDs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...