Reporting

Scheduled PDF Report Generation Error -- urlopen error [Errno 111] Connection refused

jpdubose
Explorer

Hi!

I posted this in the Splunk Forums the other day but I stumbled on Answers this morning and it seems like it may be more active. Here's my (slightly edited) post from the forums:

I was playing with the PDF report delivery feature in 4.1 and I ran into a problem.

I downloaded the pdfserver app and I've got xfvb installed. Checked the status page link in "Manager>>System Settings>>Email alert settings" and I get the sample pdf in the blue box. So I scheduled a View for PDF delivery and got the following in the email it generated:

An error occurred while generating a PDF of this report: Failed to fetch PDF from appserver: urlopen error [Errno 111] Connection refused

I started off with the "Remote PDF Report Server URL" setting blank but after I got the error message I tried "https://serverip:8089/services/pdfserver/renderpdf" I get the error message either way and either way also gets me the sample pdf on the status page.

The "Connection refused" sounded like a firewall issue but I disabled the firewall and still got the error message.

I also checked the "PDF Server Activity" view and the only line in the "Recent PDF server activity" section for an execution of the schedule is the error that is reported in the email. For viewing the sample PDF though, there are several lines relating to xfvb starting and stopping and the pdf being generated.

I'm running RHEL 5.2 and as I said, Splunk 4.1

Thanks,

Paul

Tags (3)
1 Solution

gareth
Splunk Employee
Splunk Employee

Check the "Link Hostname" setting in Manager->System Settings->Email alert settings - This is the hostname of the search head that the system is trying to contact at that point, and is the hostname used to generate the link to the results in the email that is dispatched.

If it's blank then Splunk will attempt to use the system's hostname - If that doesn't resolve, or resolves to an incorrect IP address then you will receive a connection error such as the connection refused message you're seeing currently.

Try using the search server's IP address (or 127.0.0.1 for testing if the search head and the pdf app are on the same instance) for Link Hostname and see if that resolves the issue.

View solution in original post

jpdubose
Explorer

Yes, we were still getting standard saved searches emails. I am a admin user setting this up and we have one server handling all the server functions and the management point was open.

0 Karma

gareth
Splunk Employee
Splunk Employee

Check the "Link Hostname" setting in Manager->System Settings->Email alert settings - This is the hostname of the search head that the system is trying to contact at that point, and is the hostname used to generate the link to the results in the email that is dispatched.

If it's blank then Splunk will attempt to use the system's hostname - If that doesn't resolve, or resolves to an incorrect IP address then you will receive a connection error such as the connection refused message you're seeing currently.

Try using the search server's IP address (or 127.0.0.1 for testing if the search head and the pdf app are on the same instance) for Link Hostname and see if that resolves the issue.

jpdubose
Explorer

setting the "Link Hostname" to the server's IP address seems to have fixed the problem.

Thanks!

0 Karma

matt
Splunk Employee
Splunk Employee

another question, there is nothing (iptables, ipchains, etc.) that is blocking access to the management port (8089) right?

0 Karma

matt
Splunk Employee
Splunk Employee

Is this is all being done on a single instance? Are other emails being sent successfully by Splunk? This is a simple single admin test, there is nothing special with apps and permissions right?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...