WARN SSLCommon [53742 FwdDataReceiverThread] - Received fatal SSL3 alert. ssl_state='SSLv3 read client certificate A',

[splunkreal]

Hello guys,

We are getting on one heavyforwarder this message in splunkd.log, we are using TCP-SSL inputs.conf :

“11-14-2024 16:59:44.129 +0100 WARN  SSLCommon [53742 FwdDataReceiverThread] - Received fatal SSL3 alert. ssl_state='SSLv3 read client certificate A', alert_description='unknown CA'.”

How do you identify the sourceHost ? Is it blocking incoming data or just warning?

Maybe this can help? index=_* host=myhf1 source="/OPT/splunk/var/log/splunk/metrics.log" tcp_Kprocessed="0.000"

Thanks for your help.