The CLI on the Universal Forwarder does not work when the management port is disabled

[chris]

A universal forwarder asks me to start splunk when i try to use the cli. Has anyone else experienced this or similar behaviour?

-bash-3.00$ pwd
/opt/splunkforwarder
-bash-3.00$ bin/splunk status
splunkd is running (PID: 21821).
splunk helpers are running (PIDs: 21822).
-bash-3.00$ bin/splunk list monitor
Splunk is not running, and it must be for this operation. To start splunk, run "splunk start".
-bash-3.00$ /opt/splunkforwarder/bin/splunk
couldn't run "/opt/splunkforwarder/bin/python": No such file or directory
-bash-3.00$ bin/splunk start
The splunk daemon (splunkd) is already running.
-bash-3.00$

[andyspusm]

Here's another one, in the hopes that it will help someone.

In our etc/system/local/server.conf, we had:

[sslConfig]
requireClientCert = true

This was causing the following errors:

02-17-2012 12:00:22.315 -0500 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0
02-17-2012 12:00:22.315 -0500 ERROR TcpInputFd - SSL Error for fd from HOST:localhost, IP:127.0.0.1, PORT:34566

Changing "requireClientCert" to "false" did the trick.

[chris · Accepted solution]

Ok, this is kind of embarrassing but maybe someone will run into the same issue.

We disabled the management port on our forwarders for security reasons a while ago in the server.conf file, that was the problem. Comenting out the following lines helped:

[httpServer]
disableDefaultPort = true