Getting Data In

TcpOutputProc SSL Error with SSL_read = 104 in Universal Forwarder

diavolo
Path Finder

We found the following message in splunkd.log in Universal Forwarder 7.0.2. The UF forwards logs to Splunk Cloud. It occurs infrequently, but some log files were not indexed while UF outputs this error message. I don't know the causal correlation between lack of indexing and the SSL error but, I was wondering the root cause and how to fix it.

03-08-2018 08:02:18.138 INFO TcpOutputProc - Connection to <IDX_IP>:9997 closed. default Error in SSL_read = 104, SSL Error = error:00000000:lib(0):func(0):reason(0)

Sahr_Lebbie
Path Finder

Really Late....

Is this still an issue for you?

It seems to be a networking issue for many others(outside of Splunk included) from researching this issue. It spans multiple different applications and 90% of similar issues seem to relay that it's a networking issue. The fact that you're able to connect and get inconsistent errors like this also indicates that it's likely networking issue.

Other questions would be is this the only UF affected?

0 Karma

deepashri_123
Motivator

hey diavolo,

Can you share ERROR logs in the UF.
Also check the connectivity over 9997
Have you enabled receiving on indexer on port 9997?

0 Karma

diavolo
Path Finder

The port 9997 is LISTEN and enabled receiver setting. Usually, UF forwards logs successfully without SSL errors. However, the errors occur once per a few hours with 4-6 TcpOutputProc ... SSL_read = 104 ... messages at the same time.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...