Hello guys,
We are getting on one heavyforwarder this message in splunkd.log, we are using TCP-SSL inputs.conf :
“11-14-2024 16:59:44.129 +0100 WARN SSLCommon [53742 FwdDataReceiverThread] - Received fatal SSL3 alert. ssl_state='SSLv3 read client certificate A', alert_description='unknown CA'.”
How do you identify the sourceHost ? Is it blocking incoming data or just warning?
Maybe this can help? index=_* host=myhf1 source="/OPT/splunk/var/log/splunk/metrics.log" tcp_Kprocessed="0.000"
Thanks for your help.
* If this helps, please upvote or accept solution if it solved *
