Splunk Search

streamfwd is shutting down

satishsdange
Builder

Has anyone faced this problem -

root@ip-172-31-19-68:/home/ubuntu# tail /opt/splunkforwarder/var/log/splunk/streamfwd.log
2016-05-26 05:05:45 INFO 140144301864832 stream.main - web interface listening on port 8889
2016-05-26 05:11:01 INFO 140144301864832 stream.main - streamfwd is shutting down
2016-05-26 05:10:58 INFO 139783477241728 stream.CaptureServer - Found DataDirectory: /opt/splunkforwarder/etc/apps/Splunk_TA_stream/data
2016-05-26 05:10:58 INFO 139783477241728 stream.CaptureServer - Found UIDirectory: /opt/splunkforwarder/etc/apps/Splunk_TA_stream/ui
2016-05-26 05:10:59 INFO 139783477241728 stream.CaptureServer - Default configuration directory: /opt/splunkforwarder/etc/apps/Splunk_TA_stream/default
2016-05-26 05:10:59 INFO 139783477241728 stream.CaptureServer - Starting data capture
2016-05-26 05:10:59 INFO 139783477241728 stream.main - streamfwd has started successfully (version 6.5.0 build 233)
2016-05-26 05:10:59 INFO 139783477241728 stream.main - web interface listening on port 8889
2016-05-26 05:11:08 WARN 139783339513600 stream.SnifferReactor - SSL decryption error (unrecognized SSL version) (ssl) [c=202.47.24.180:38361, s=172.31.19.68:80]
2016-05-26 06:05:12 INFO 139783477241728 stream.main - streamfwd is shutting down

Tags (1)
0 Karma

satishsdange
Builder

Problem has been fixed.

Root cause - Configured ip address to 0.0.0.0 which was bringing stream forwarder down. Just changed it to interface ip & now its working.

root@ip-172-31-19-68:/opt/splunkforwarder/etc/apps/Splunk_TA_stream/local# cat streamfwd.conf
[streamfwd]
port = 8889
ipAddr = 0.0.0.0
root@ip-172-31-19-68:/opt/splunkforwarder/etc/apps/Splunk_TA_stream/local#

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...