Splunk Enterprise

Splunk Universal forwarder management port is closed

eduardo1989
Path Finder

Hi All,

I updated Splunk Universal forwarder from 8.2.6 to 9.1.3 on a Debian host. No specific configuration basically, everything by default. I would like to use the REST capabilities which I already used with the older version but this time the port is not listening, however startup says its listening.
Checking mgmt port [8089]: open
Netstat shows no 8089 as well.
Host has no firewall, no bulls**t, just pure playground and as I said older version worked perfectly.
What can be the problem, another bug in the software?

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The report at startup indicates port 8089 is not in use by any process (it's "open" for use).  It does not mean Splunk is listening on that port (at least not yet).

Version 9.0 changed the default behavior of the UF's management port.  See the Release Notes at https://docs.splunk.com/Documentation/Splunk/9.0.8/ReleaseNotes/MeetSplunk#What.27s_New_in_9.0

https://docs.splunk.com/Documentation/Splunk/9.0.8/ReleaseNotes/MeetSplunk#What.27s_New_in_9.0

---
If this reply helps you, Karma would be appreciated.
0 Karma

ww9rivers
Contributor

I am having the same issue. I have also checked the Release Notes you linked. I already have those items configured:

$ bin/splunk btool web list | grep mgmtHostPort
mgmtHostPort = 0.0.0.0:8089
$ bin/splunk btool server list | grep disableDefaultPort
disableDefaultPort = false

But still, I don't see splunkd listening on port 8089:
$ sudo lsof -i tcp -P | grep 8089

(I get nothing.)

The Universal Forwarder is v9.2.1 on Red Hat Enterprise Linux 8.9.

0 Karma

eduardo1989
Path Finder

The thing is it does not listen at all on Linux after the mentioned version. On windows I could check and it works as defined. As it is written by default it is limited to localhost. 

Anyways thanks for this info.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What you described is the new default behavior.

---
If this reply helps you, Karma would be appreciated.

edmondpalcsarbi
Engager

Yes, in the meantime it turned out the default way it to listen on a UNIX Domain Socket and I need to switch with config back to the tcp method. 🙂

0 Karma

patelmc19
Loves-to-Learn

What do you mean by need to switch with config back to the tcp method?
How did you do that?

after this change do you see it listen to port 8089?

netstat -pant | egrep 8089  - do you see listen ?

0 Karma

ww9rivers
Contributor

This is what I have in "server.conf", in addition to what I have in "web.conf":

[httpServer]
disableDefaultPort = false
mgmtMode = tcp

After that, splunkd starts to listen to TCP port 8089.

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...