Getting Data In

The CLI on the Universal Forwarder does not work when the management port is disabled

chris
Motivator

A universal forwarder asks me to start splunk when i try to use the cli. Has anyone else experienced this or similar behaviour?

-bash-3.00$ pwd
/opt/splunkforwarder
-bash-3.00$ bin/splunk status
splunkd is running (PID: 21821).
splunk helpers are running (PIDs: 21822).
-bash-3.00$ bin/splunk list monitor
Splunk is not running, and it must be for this operation. To start splunk, run "splunk start".
-bash-3.00$ /opt/splunkforwarder/bin/splunk
couldn't run "/opt/splunkforwarder/bin/python": No such file or directory
-bash-3.00$ bin/splunk start
The splunk daemon (splunkd) is already running.
-bash-3.00$
1 Solution

chris
Motivator

Ok, this is kind of embarrassing but maybe someone will run into the same issue.

We disabled the management port on our forwarders for security reasons a while ago in the server.conf file, that was the problem. Comenting out the following lines helped:

[httpServer]
disableDefaultPort = true

View solution in original post

andyspusm
Explorer

Here's another one, in the hopes that it will help someone.

In our etc/system/local/server.conf, we had:

[sslConfig]
requireClientCert = true

This was causing the following errors:

02-17-2012 12:00:22.315 -0500 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0
02-17-2012 12:00:22.315 -0500 ERROR TcpInputFd - SSL Error for fd from HOST:localhost, IP:127.0.0.1, PORT:34566

Changing "requireClientCert" to "false" did the trick.

chris
Motivator

Ok, this is kind of embarrassing but maybe someone will run into the same issue.

We disabled the management port on our forwarders for security reasons a while ago in the server.conf file, that was the problem. Comenting out the following lines helped:

[httpServer]
disableDefaultPort = true

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.