WARN SSLCommon [53742 FwdDataReceiverThread] - Re...

Getting Data In

Hello guys,

We are getting on one heavyforwarder this message in splunkd.log, we are using TCP-SSL inputs.conf :

“11-14-2024 16:59:44.129 +0100 WARN SSLCommon [53742 FwdDataReceiverThread] - Received fatal SSL3 alert. ssl_state='SSLv3 read client certificate A', alert_description='unknown CA'.”

How do you identify the sourceHost ? Is it blocking incoming data or just warning?

Maybe this can help? index=_* host=myhf1 source="/OPT/splunk/var/log/splunk/metrics.log" tcp_Kprocessed="0.000"

Thanks for your help.

* If this helps, please upvote or accept solution if it solved *

Get Updates on the Splunk Community!

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...

WARN SSLCommon [53742 FwdDataReceiverThread] - Received fatal SSL3 alert. ssl_state='SSLv3 read client certificate A',

data

heavy forwarder

inputs.conf

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Quick connection discovery mode for forwarders

Build and Launch AI Agents from Your Splunk Workflows

Splunk Cloud Application Management in Terraform

Join the Conversation

WARN SSLCommon [53742 FwdDataReceiverThread] - Received fatal SSL3 alert. ssl_state='SSLv3 read client certificate A',

data

heavy forwarder

inputs.conf

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Quick connection discovery mode for forwarders

Build and Launch AI Agents from Your Splunk Workflows

Splunk Cloud Application Management in Terraform