Getting Data In

Universal Forwarder DsBind failed since upgrade to 6.0.2

Ed_Alias
Path Finder

Hi,

i juste upgraded my universal Forwarder on a windows server,

and since it gives me this error in Splunkd.log

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - EvtDC::connectToDC: DsBind failed: (1722)

forwarder is still working but serveclass didn't update ...

help would be greate 😃

1 Solution

itopsdci
Explorer

FYI, I resolved this in my own Splunk deployment. In $SPLUNK_HOME/etc/apps/$WINDOWS_ADDON/local/inputs.conf I had quotes around our domain name for evt_dc_name. I removed them, the problem went away, and our wineventlog:security events stopped being delayed. This behavior began after upgrading our deployment to 6.0.2.

View solution in original post

chanfoli
Builder

If you are seeing these errors with a basic event logging setup and you don't have your universal forwarders talking to AD to resolve AD objects in events, you might want to try this in your inputs.conf:

evt_resolve_ad_obj = 0

This tells the forwarder not to try to resolve AD objects. The default with this input type is to do so but if you don't set up the AD binding with evt_dc_name or evt_dns_name it does not work so you will see tons of these errors.

nk-1
Path Finder

Adding

[default]

evt_resolve_ad_obj = 0

to inputs.conf (on our Universal Forwarders) fixed the problem here when our Windows AD server changed.

Thanks!

boopaljothi
Explorer

do we need to add this in limits.conf or inputs.conf?

0 Karma

nk-1
Path Finder

SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf
only, in my setup.
My apologies for the previous typo. Will fix it.

0 Karma

boopaljothi
Explorer

i still get the same error even after adding that

0 Karma

arber
Communicator

Same problem even with version 6.2 is there any fix on this ?

0 Karma

slebbie_splunk
Splunk Employee
Splunk Employee

@arber have you tried the

[default]
evt_resolve_ad_obj = 0

fix?

0 Karma

itopsdci
Explorer

FYI, I resolved this in my own Splunk deployment. In $SPLUNK_HOME/etc/apps/$WINDOWS_ADDON/local/inputs.conf I had quotes around our domain name for evt_dc_name. I removed them, the problem went away, and our wineventlog:security events stopped being delayed. This behavior began after upgrading our deployment to 6.0.2.

View solution in original post

robert_miller
Path Finder

I have that field blank and I am still getting the errors. We use multiple domains so I am not sure if putting in a domain name is feasible. Any other ideas?

0 Karma

Ed_Alias
Path Finder

And thanks to you my forwader is happy again ! :

TcpOutputProc - Connected to idx=10.2xx.xxx.xxx:9997 using ACK

Thank you !

0 Karma

itopsdci
Explorer

Same here. I ran across this while troubleshooting the fact that the wineventlogs stopped coming across on a couple of DCs. Whatever is causing this...not fun.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.