Security

ERROR TcpInputFd - SSL Error - what does it mean?

Mick
Splunk Employee
Splunk Employee

I have a lot of these ERROR messages in the splunkd.log on my indexing instance, what is it trying to tell me?

A snippet of the log says -

01-22-2010 15:21:24.544 ERROR TcpInputFd - SSL Error = error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 
01-22-2010 15:21:24.544 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0 
01-22-2010 15:21:24.544 ERROR TcpInputFd - SSL Error for fd from HOST:<hostName>, IP:<Ip_Address>, PORT:<port#> 
Tags (4)

Strype
Path Finder

Retina Scan... That's what's causing mine. Check any vulnerability scan times against the error time.

0 Karma

Chris_R_
Splunk Employee
Splunk Employee

You will see this error if SSL is enabled on the indexer but not configured to forward w/ssl attempting to make the connections.

To enable SSL forwarding please see this document for details. http://www.splunk.com/base/Documentation/4.0.8/Admin/UseSSLencryptionbetweenforwardersandreceivers

Lowell
Super Champion

I have no SSL forwarding or receiving setup and I'm still seeing similar error messages.

0 Karma

V_at_Splunk
Splunk Employee
Splunk Employee

How do I get rid of this error message -- for now at least? (I've filed a bug on this, since ERROR message should only be result of an error condition.)

Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...