Splunk Universal forwarder management port is closed

[eduardo1989]

Hi All,

I updated Splunk Universal forwarder from 8.2.6 to 9.1.3 on a Debian host. No specific configuration basically, everything by default. I would like to use the REST capabilities which I already used with the older version but this time the port is not listening, however startup says its listening.
Checking mgmt port [8089]: open
Netstat shows no 8089 as well.
Host has no firewall, no bulls**t, just pure playground and as I said older version worked perfectly.
What can be the problem, another bug in the software?

[richgalloway]

The report at startup indicates port 8089 is not in use by any process (it's "open" for use).  It does not mean Splunk is listening on that port (at least not yet).

Version 9.0 changed the default behavior of the UF's management port.  See the Release Notes at https://docs.splunk.com/Documentation/Splunk/9.0.8/ReleaseNotes/MeetSplunk#What.27s_New_in_9.0

https://docs.splunk.com/Documentation/Splunk/9.0.8/ReleaseNotes/MeetSplunk#What.27s_New_in_9.0

[ww9rivers]

I am having the same issue. I have also checked the Release Notes you linked. I already have those items configured:

$ bin/splunk btool web list | grep mgmtHostPort
mgmtHostPort = 0.0.0.0:8089
$ bin/splunk btool server list | grep disableDefaultPort
disableDefaultPort = false

But still, I don't see splunkd listening on port 8089:
$ sudo lsof -i tcp -P | grep 8089

(I get nothing.)

The Universal Forwarder is v9.2.1 on Red Hat Enterprise Linux 8.9.

[eduardo1989]

The thing is it does not listen at all on Linux after the mentioned version. On windows I could check and it works as defined. As it is written by default it is limited to localhost. 

Anyways thanks for this info.

[richgalloway]

What you described is the new default behavior.

[edmondpalcsarbi]

Yes, in the meantime it turned out the default way it to listen on a UNIX Domain Socket and I need to switch with config back to the tcp method. 🙂

[patelmc19]

What do you mean by need to switch with config back to the tcp method?
How did you do that?

after this change do you see it listen to port 8089?

netstat -pant | egrep 8089  - do you see listen ?

[ww9rivers]

This is what I have in "server.conf", in addition to what I have in "web.conf":

[httpServer]
disableDefaultPort = false
mgmtMode = tcp

After that, splunkd starts to listen to TCP port 8089.