Splunk for Cisco IPS - connects to IPS every second regardless of "interval" setting

[joshd]

Hello,

I've noticed after changing the interval setting within the inputs.conf for our various IPS' it still connects to the IPS' every 1 second regardless of what I set the interval to. Is there a reason for it not respecting this value? or is there a setting that I may be missing?

Thanks, Josh

[ysouchon]

Hi Josh,

I have the same troubles than you. After a quick look, I think I found the mistake :

File get_ips_feed.py :

[...]
58 while 1:

59 try:

60 sdee.get()

61 except:

[...]

I do not know why, but the loop runs forever, there is no exit / break into this loop.
We should ask Splunk why....maybe it's a bug.

A quick and dirty fix, add a break at the end of the loop :

167 ### Commen/Uncomment to write to stdout

168 # print syslog_msg +"\n"

169 break

It seems to work for me. Do not forget to change the "interval" option to 60 for example.
Let me know if it works for you too.

[dleung]

Hey Josh, the SDEE connection module, used by get_ips_feed.py, has a default 1 second retry on unsuccessful connections. As such, it sounds like it might be a connection issue.

The scripted input writes to log file $SPLUNK_HOME/var/log/splunk/sdee_get.log which contains status information for the connection. Have you tried checking that to see if there's any information there?

[joshd]

Yeah, I looked into the sdee_get.log initially and it does not report any issues, it shows successful connections to the IPS and then no more repeat messages. When I actually look at the process list on the machine (ps aux), I see the processes constantly running, should this be the case or should I only see them in the process list every X-minutes as they are configured within the inputs.conf