macOS Universal Forwarder

[user487596]

Hello everyone! I need help/hint: I tried to set up log forwarding from MacOS (ARM) to Splunk, but the logs never arrived. I followed the instructions from this video, and also installed and configured Add-on for Unix and Linux. And what index will they appear in? Thanks!

Inside /Applications/SplunkForwarder/etc/system/local i have: inputs.conf, outputs.conf, server.conf.

inputs.conf

[monitor:///var/log/system.log]
disabled = 0

outputs.conf

[tcpout:default-autolb-group]
server = ip:9997
compressed = true

[tcpout-server://ip:9997]

server.conf

[general]
serverName = 
pass4SymmKey = 

[sslConfig]
sslPassword = 

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
peers = *
quota = MAX
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
peers = *
quota = MAX
stack_id = free

[dural_yyz · Accepted solution]

Look at the local splunkd.log file to see any connection attempts to the destination IP.

[user487596]

WARN  TcpOutputProc [22637 parsing] - The TCP output processor has paused the data flow. Forwarding to host_dest=ip inside output group default-autolb-group from host_src= has been blocked for blocked_seconds=16061. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.

ERROR TcpOutputFd [22638 TcpOutEloop] - Read error. Connection reset by peer

It turns out there is no network interaction between the workstation and the splunk?

[dural_yyz]

Here we go.  So this could be network transmissions so check for firewall blocks and any routing issues first.  Then look into SSL connection issues last.