universalforwarder 4.2.1 unable to connect to index server 4.2.1 with sslv3

[deyeo]

have enabled SSLv3 on splunk 4.2.1 index server and universalforwarder 4.2.1, universalforwarder doesn't seem to be able to communicate to the index server. please advise what can i do?

On Universalforwarder 4.2.1's splunkd.log:

05-05-2011 07:07:53.276 -0400 INFO  TcpOutputProc - Connection to xx.xx.xx.xx:8089 closed. Read error. Connection reset by peer

05-05-2011 07:07:53.282 -0400 INFO  TcpOutputProc - Connected to idx=xx.xx.xx.xx:8089

On Splunk Index server 4.2.1's splunkd.log:

05-05-2011 07:23:12.649 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:xxxxx, IP:yy.yy.yy.yy, PORT:54521

05-05-2011 07:23:12.650 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:xxxxx, IP:yy.yy.yy.yy, PORT:54525

[deyeo]

oh gosh. tmeader, you are right.

i think it is this command that is the culprit:

~/bin/splunk add forward-server xx.xx.xx.xx:9997

it writes into this file: ~/etc/system/local/outputs.conf
to contain

[tcpout]
defaultGroup = xx.xx.xx.xx_9997
disabled = false

[tcpout:xx.xx.xx.xx_9997]
server = xx.xx.xx.xx:9997

[tcpout-server://xx.xx.xx.xx:9997]

i have to manually change it to:

   [tcpout]
    disabled = false
    indexAndForward = 0

[tmeader · Accepted solution]

I'm a bit confused. What is the Universal Forwarder trying to talk to the Indexer on 8089 for? 8089 is the port used for Splunk program level communication (such as license server traffic, etc). The forwarder should be sending to the indexer on a standard port that the indexer is configured to listen on, by default port 9997.

[ftk]

Can you post your relevant configs? (outputs.conf from UF, inputs.conf from Indexer)