Splunk 6.6.2 error sending alert email "ERROR:root:EOF occurred in violation of protocol (_ssl.c:676)"


I just upgraded from Splunk 6.5.2 to 6.6.2 and now the emailing of alerts when using STARTTLS is broken. Looking at the splunkd.log file I can see the error ERROR:root:EOF occurred in violation of protocol (_ssl.c:676).

Email works correctly if I disable the SMTP STARTTLS option in email settings which is less than ideal.

0 Karma


It looks like there is a known issue when upgrading Splunk 6.5.x to Splunk 6.6.2.

I followed the guide and added $SPLUNK_HOME/etc/system/local/alert_actions.conf and added

sslVersions = *,-ssl2
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

I then restarted the server and it was emailing again.

Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...