What is causing AwsSDK error?

[vik]

Hi Team, 

We are noticing suddenly started noticing these errors in splunkd log. Any idea what could cause these ? We didnt make any changes to the splunkforwarder app. 

06-01-2023 20:40:19.027 -0700 ERROR AwsSDK [4839 ExecProcessor] - CurlHttpClient Curl returned error code 28 - Timeout was reached
06-01-2023 20:40:19.027 -0700 ERROR AwsSDK [4839 ExecProcessor] - EC2MetadataClient Http request to retrieve credentials failed
06-01-2023 20:40:20.029 -0700 ERROR AwsSDK [4839 ExecProcessor] - CurlHttpClient Curl returned error code 28 - Timeout was reached
06-01-2023 20:40:20.029 -0700 ERROR AwsSDK [4839 ExecProcessor] - EC2MetadataClient Http request to retrieve credentials failed
06-01-2023 20:40:20.029 -0700 ERROR AwsSDK [4839 ExecProcessor] - EC2MetadataClient Can not retrive resource from http://169.254.169.254/latest/meta-data/placement/availability-zone

[hahabuknow]

Hi @vik  , I'm encountering the same issue. Did you resolve it?

[isoutamo]

As it access local endpoint, could it be that your server have increased load so much that timeout has reached?

[vik]

The IP seems to be a generic IP and it does not seem to be a local endpoint. I could see other posts on the internet have the same IP.

It seems like something is the system is trying to invoke this endpoint. But I do not understand what is triggering this endpoint.  

[isoutamo]

This IP is for AWS:s internal local endpoint to collect AWS instance information using REST API like calling it with curl. It's same on all AWS EC2 instances and you could get e.g. region, zone, instance type etc. from it.