Getting Data In

TcpOutputProc SSL Error with SSL_read = 104 in Universal Forwarder

diavolo
Path Finder

We found the following message in splunkd.log in Universal Forwarder 7.0.2. The UF forwards logs to Splunk Cloud. It occurs infrequently, but some log files were not indexed while UF outputs this error message. I don't know the causal correlation between lack of indexing and the SSL error but, I was wondering the root cause and how to fix it.

03-08-2018 08:02:18.138 INFO TcpOutputProc - Connection to <IDX_IP>:9997 closed. default Error in SSL_read = 104, SSL Error = error:00000000:lib(0):func(0):reason(0)

Sahr_Lebbie
Path Finder

Really Late....

Is this still an issue for you?

It seems to be a networking issue for many others(outside of Splunk included) from researching this issue. It spans multiple different applications and 90% of similar issues seem to relay that it's a networking issue. The fact that you're able to connect and get inconsistent errors like this also indicates that it's likely networking issue.

Other questions would be is this the only UF affected?

0 Karma

deepashri_123
Motivator

hey diavolo,

Can you share ERROR logs in the UF.
Also check the connectivity over 9997
Have you enabled receiving on indexer on port 9997?

0 Karma

diavolo
Path Finder

The port 9997 is LISTEN and enabled receiver setting. Usually, UF forwards logs successfully without SSL errors. However, the errors occur once per a few hours with 4-6 TcpOutputProc ... SSL_read = 104 ... messages at the same time.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...