Getting Data In
Highlighted

Splunk for Cisco IPS - connects to IPS every second regardless of "interval" setting

SplunkTrust
SplunkTrust

Hello,

I've noticed after changing the interval setting within the inputs.conf for our various IPS' it still connects to the IPS' every 1 second regardless of what I set the interval to. Is there a reason for it not respecting this value? or is there a setting that I may be missing?

Thanks, Josh

0 Karma
Highlighted

Re: Splunk for Cisco IPS - connects to IPS every second regardless of "interval" setting

Path Finder

Hey Josh, the SDEE connection module, used by get_ips_feed.py, has a default 1 second retry on unsuccessful connections. As such, it sounds like it might be a connection issue.

The scripted input writes to log file $SPLUNK_HOME/var/log/splunk/sdee_get.log which contains status information for the connection. Have you tried checking that to see if there's any information there?

0 Karma
Highlighted

Re: Splunk for Cisco IPS - connects to IPS every second regardless of "interval" setting

SplunkTrust
SplunkTrust

Yeah, I looked into the sdee_get.log initially and it does not report any issues, it shows successful connections to the IPS and then no more repeat messages. When I actually look at the process list on the machine (ps aux), I see the processes constantly running, should this be the case or should I only see them in the process list every X-minutes as they are configured within the inputs.conf

0 Karma
Highlighted

Re: Splunk for Cisco IPS - connects to IPS every second regardless of "interval" setting

Explorer

Hi Josh,

I have the same troubles than you. After a quick look, I think I found the mistake :

File getipsfeed.py :

[...]
58 while 1:

59 try:

60 sdee.get()

61 except:

[...]

I do not know why, but the loop runs forever, there is no exit / break into this loop.
We should ask Splunk why....maybe it's a bug.

A quick and dirty fix, add a break at the end of the loop :

167 ### Commen/Uncomment to write to stdout

168 # print syslog_msg +"\n"

169 break

It seems to work for me. Do not forget to change the "interval" option to 60 for example.
Let me know if it works for you too.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.