Security

ERROR TcpInputFd - SSL Error - what does it mean?

Mick
Splunk Employee
Splunk Employee

I have a lot of these ERROR messages in the splunkd.log on my indexing instance, what is it trying to tell me?

A snippet of the log says -

01-22-2010 15:21:24.544 ERROR TcpInputFd - SSL Error = error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 
01-22-2010 15:21:24.544 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0 
01-22-2010 15:21:24.544 ERROR TcpInputFd - SSL Error for fd from HOST:<hostName>, IP:<Ip_Address>, PORT:<port#> 
Tags (4)

Strype
Path Finder

Retina Scan... That's what's causing mine. Check any vulnerability scan times against the error time.

0 Karma

Chris_R_
Splunk Employee
Splunk Employee

You will see this error if SSL is enabled on the indexer but not configured to forward w/ssl attempting to make the connections.

To enable SSL forwarding please see this document for details. http://www.splunk.com/base/Documentation/4.0.8/Admin/UseSSLencryptionbetweenforwardersandreceivers

Lowell
Super Champion

I have no SSL forwarding or receiving setup and I'm still seeing similar error messages.

0 Karma

V_at_Splunk
Splunk Employee
Splunk Employee

How do I get rid of this error message -- for now at least? (I've filed a bug on this, since ERROR message should only be result of an error condition.)

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...