Monitoring Splunk

Strange warning message, issues Splunking Active Directory

samlaw
Explorer

Having issues receiving data from my AD,
Firewall is set to allow 9997 and 8089 TCP/UDP Outbound and Inbound

I get the below Error and warning in my splunkd.log

11-06-2013 06:59:02.526 +1300 ERROR TcpOutputFd - Resurrect failure
11-06-2013 06:59:02.994 +1300 WARN TcpOutputProc - Connected to idx=10.21.12.195:9997. Not using ACK.

0 Karma
1 Solution

yong_ly
Path Finder

Looks like a network issue, check these things:

  1. That port 9997 is not being used by another application.
  2. the local firewall settings on the AD are set up properly. e.g. iptables
  3. Splunk versions are compatible between indexer and forwarder

I would also do a packet trace on both the splunk server and the AD machine to confirm that there's no packet loss or strange behaviour from the AD. You can compare it to a packet trace on a machine that works properly to see if there's any discrepancies.

View solution in original post

0 Karma

samlaw
Explorer

Issue was due to Forwarder being 5.0 and Indexer being 6.0, thanks, should have noticed that one :S

0 Karma

yong_ly
Path Finder

Looks like a network issue, check these things:

  1. That port 9997 is not being used by another application.
  2. the local firewall settings on the AD are set up properly. e.g. iptables
  3. Splunk versions are compatible between indexer and forwarder

I would also do a packet trace on both the splunk server and the AD machine to confirm that there's no packet loss or strange behaviour from the AD. You can compare it to a packet trace on a machine that works properly to see if there's any discrepancies.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...