TcpOutputProc SSL Error with SSL_read = 104 in Universal Forwarder

[diavolo]

We found the following message in splunkd.log in Universal Forwarder 7.0.2. The UF forwards logs to Splunk Cloud. It occurs infrequently, but some log files were not indexed while UF outputs this error message. I don't know the causal correlation between lack of indexing and the SSL error but, I was wondering the root cause and how to fix it.

03-08-2018 08:02:18.138 INFO TcpOutputProc - Connection to <IDX_IP>:9997 closed. default Error in SSL_read = 104, SSL Error = error:00000000:lib(0):func(0):reason(0)

[Sahr_Lebbie]

Really Late....

Is this still an issue for you?

It seems to be a networking issue for many others(outside of Splunk included) from researching this issue. It spans multiple different applications and 90% of similar issues seem to relay that it's a networking issue. The fact that you're able to connect and get inconsistent errors like this also indicates that it's likely networking issue.

Other questions would be is this the only UF affected?

[deepashri_123]

hey diavolo,

Can you share ERROR logs in the UF.
Also check the connectivity over 9997
Have you enabled receiving on indexer on port 9997?

[diavolo]

The port 9997 is LISTEN and enabled receiver setting. Usually, UF forwards logs successfully without SSL errors. However, the errors occur once per a few hours with 4-6 TcpOutputProc ... SSL_read = 104 ... messages at the same time.