Splunk 6.6.2 error sending alert email "ERROR:root:EOF occurred in violation of protocol (_ssl.c:676)"


I just upgraded from Splunk 6.5.2 to 6.6.2 and now the emailing of alerts when using STARTTLS is broken. Looking at the splunkd.log file I can see the error ERROR:root:EOF occurred in violation of protocol (_ssl.c:676).

Email works correctly if I disable the SMTP STARTTLS option in email settings which is less than ideal.

0 Karma


It looks like there is a known issue when upgrading Splunk 6.5.x to Splunk 6.6.2.

I followed the guide and added $SPLUNK_HOME/etc/system/local/alert_actions.conf and added

sslVersions = *,-ssl2
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

I then restarted the server and it was emailing again.

Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...