Monitoring Splunk

What is causing AwsSDK error?

vik
Explorer

Hi Team, 

 

We are noticing suddenly started noticing these errors in splunkd log. Any idea what could cause these ? We didnt make any changes to the splunkforwarder app. 

 

06-01-2023 20:40:19.027 -0700 ERROR AwsSDK [4839 ExecProcessor] - CurlHttpClient Curl returned error code 28 - Timeout was reached
06-01-2023 20:40:19.027 -0700 ERROR AwsSDK [4839 ExecProcessor] - EC2MetadataClient Http request to retrieve credentials failed
06-01-2023 20:40:20.029 -0700 ERROR AwsSDK [4839 ExecProcessor] - CurlHttpClient Curl returned error code 28 - Timeout was reached
06-01-2023 20:40:20.029 -0700 ERROR AwsSDK [4839 ExecProcessor] - EC2MetadataClient Http request to retrieve credentials failed
06-01-2023 20:40:20.029 -0700 ERROR AwsSDK [4839 ExecProcessor] - EC2MetadataClient Can not retrive resource from http://169.254.169.254/latest/meta-data/placement/availability-zone

Labels (4)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
As it access local endpoint, could it be that your server have increased load so much that timeout has reached?
0 Karma

vik
Explorer

The IP seems to be a generic IP and it does not seem to be a local endpoint. I could see other posts on the internet have the same IP.

It seems like something is the system is trying to invoke this endpoint. But I do not understand what is triggering this endpoint.  

0 Karma

isoutamo
SplunkTrust
SplunkTrust

This IP is for AWS:s internal local endpoint to collect AWS instance information using REST API like calling it with curl. It's same on all AWS EC2 instances and you could get e.g. region, zone, instance type etc. from it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...