Getting Data In

universalforwarder 4.2.1 unable to connect to index server 4.2.1 with sslv3

Path Finder

have enabled SSLv3 on splunk 4.2.1 index server and universalforwarder 4.2.1, universalforwarder doesn't seem to be able to communicate to the index server. please advise what can i do?

On Universalforwarder 4.2.1's splunkd.log:

05-05-2011 07:07:53.276 -0400 INFO  TcpOutputProc - Connection to xx.xx.xx.xx:8089 closed. Read error. Connection reset by peer

05-05-2011 07:07:53.282 -0400 INFO  TcpOutputProc - Connected to idx=xx.xx.xx.xx:8089

On Splunk Index server 4.2.1's splunkd.log:

05-05-2011 07:23:12.649 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:xxxxx, IP:yy.yy.yy.yy, PORT:54521

05-05-2011 07:23:12.650 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:xxxxx, IP:yy.yy.yy.yy, PORT:54525
Tags (2)
0 Karma
1 Solution

Contributor

I'm a bit confused. What is the Universal Forwarder trying to talk to the Indexer on 8089 for? 8089 is the port used for Splunk program level communication (such as license server traffic, etc). The forwarder should be sending to the indexer on a standard port that the indexer is configured to listen on, by default port 9997.

View solution in original post

Path Finder

oh gosh. tmeader, you are right.

i think it is this command that is the culprit:

~/bin/splunk add forward-server xx.xx.xx.xx:9997

it writes into this file: ~/etc/system/local/outputs.conf
to contain

[tcpout]
defaultGroup = xx.xx.xx.xx_9997
disabled = false

[tcpout:xx.xx.xx.xx_9997]
server = xx.xx.xx.xx:9997

[tcpout-server://xx.xx.xx.xx:9997]

i have to manually change it to:

   [tcpout]
    disabled = false
    indexAndForward = 0
0 Karma

Contributor

I'm a bit confused. What is the Universal Forwarder trying to talk to the Indexer on 8089 for? 8089 is the port used for Splunk program level communication (such as license server traffic, etc). The forwarder should be sending to the indexer on a standard port that the indexer is configured to listen on, by default port 9997.

View solution in original post

Motivator

Can you post your relevant configs? (outputs.conf from UF, inputs.conf from Indexer)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!