Scheduled PDF Report Generation Error -- urlopen error [Errno 111] Connection refused

[jpdubose]

Hi!

I posted this in the Splunk Forums the other day but I stumbled on Answers this morning and it seems like it may be more active. Here's my (slightly edited) post from the forums:

I was playing with the PDF report delivery feature in 4.1 and I ran into a problem.

I downloaded the pdfserver app and I've got xfvb installed. Checked the status page link in "Manager>>System Settings>>Email alert settings" and I get the sample pdf in the blue box. So I scheduled a View for PDF delivery and got the following in the email it generated:

An error occurred while generating a PDF of this report: Failed to fetch PDF from appserver: urlopen error [Errno 111] Connection refused

I started off with the "Remote PDF Report Server URL" setting blank but after I got the error message I tried "https://serverip:8089/services/pdfserver/renderpdf" I get the error message either way and either way also gets me the sample pdf on the status page.

The "Connection refused" sounded like a firewall issue but I disabled the firewall and still got the error message.

I also checked the "PDF Server Activity" view and the only line in the "Recent PDF server activity" section for an execution of the schedule is the error that is reported in the email. For viewing the sample PDF though, there are several lines relating to xfvb starting and stopping and the pdf being generated.

I'm running RHEL 5.2 and as I said, Splunk 4.1

Thanks,

Paul

[jpdubose]

Yes, we were still getting standard saved searches emails. I am a admin user setting this up and we have one server handling all the server functions and the management point was open.

[gareth · Accepted solution]

Check the "Link Hostname" setting in Manager->System Settings->Email alert settings - This is the hostname of the search head that the system is trying to contact at that point, and is the hostname used to generate the link to the results in the email that is dispatched.

If it's blank then Splunk will attempt to use the system's hostname - If that doesn't resolve, or resolves to an incorrect IP address then you will receive a connection error such as the connection refused message you're seeing currently.

Try using the search server's IP address (or 127.0.0.1 for testing if the search head and the pdf app are on the same instance) for Link Hostname and see if that resolves the issue.

[jpdubose]

setting the "Link Hostname" to the server's IP address seems to have fixed the problem.

Thanks!

[matt]

another question, there is nothing (iptables, ipchains, etc.) that is blocking access to the management port (8089) right?

[matt]

Is this is all being done on a single instance? Are other emails being sent successfully by Splunk? This is a simple single admin test, there is nothing special with apps and permissions right?