Why did logs stopped abruptly after installing UF on my windows?

[thevikramyadav]

Hi Guys, I have UF installed on my windows machine, abruptly last month logs got stopped. I check in splunkd log file and saw the error
TcpOutputFd [800 TcpOutEloop] - Connection to host=xx.xxx.xxx.xxx:9997 failed

Also after restarting, it resumes sending logs to Splunk for some days but again it will stop and gives the same error.

Not sure how to fix this issue and proceed.

[yazeedallabadi2]

Any updates on how to fix this issue.
We are facing a similar issue where hosts randomly stop reporting to the HF. Restarting the Splunk Universal Forwarder service fixes the issue for a while before the issue comes back again and the hosts stop reporting to Splunk HF again.

[burwell]

Hi @yazeedallabadi2 did you see this https://splunk.my.site.com/customer/s/article/HF-paused-data-flow-due-to-connection-timeout-but-didn...

I see that it says it affects UF as well as HF

[PickleRick]

And are you sure that it's the Splunk's issue? From the symptoms it could as well be a lot of other issues - OS-level ones, network ones... Have you done _any_ troubleshooting or just assumed that it's Splunk's fault? I'm not saying it isn't but how did you come to that conclusion?

[gcusello]

Hi @thevikramyadav,

if your Splunk server continues to receive logs from other Universal Forwarders, the problem could be in the connection.

Check it using telnet:

telnet <ip_splunk_server> 9997

maybe something changed in the firewall rules.

Ciao.

Giuseppe