About molinarf

molinarf · ‎06-20-2018

I have been trying to get the Cisco eStreamer eNcore app to work and since rebuilding the FMC host, and using a routable IP instead of a management IP. The eStreamer Client Status shows Disabled. Here is the output of the config.log /opt/splunk/etc/apps/TA-eStreamer/bin/encore You have not configured your FMC Host Configuring Removing old keys Recreating keys MAC verified OK Error outputting keys and certificates 139742838814376:error:060A60A3:digital envelope routines:FIPS_CIPHERINIT:diabled for fips:fips_enc.c:142: 139742838814376:error:06074078: digital envelope routines:EVP_PBE_CipherInit:keygen failure:evp_pbe.c:197: 139742838814376:error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algo ciperinit error:p12_decr.c:87: 139742838814376:error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error:p12_decr.c:139: I don't know what the error means that I have not configured the FMC Host. Are the errors related to the problem of the eStreamer stuck in disabled? The eStreamer.log file output shows: estreamer.client INFO eNcore version: 3.0.0 estreamer.client INFO Python version: 2.7.14 (default, April 12 2018) \n[GCC 5.3.0] estreamer.client INFO Platform version: Linux-2.6.696.e16.x86_64-x86_64-with-rehat-6.9-Santiago estreamer.client INFO Starting client (pid=28587). estreamer.client INFO Sha256: Diagnostics INFO Check certificate Diagnostics INFO PKCS12 file needs processing estreamer.client ERROR EncoreException: Uable to read password from console. Are you running as a background process? Try running in test or foreground mode estreamer.client INFO Stopping... extreamer.monitor INFO stopping monitor estreamer.client INFO Goodbye I am currently running Splunk Enterprise 7.1.1 on Linux RHEL 6.9-Santiago Thank you.

molinarf · ‎05-29-2018

Can anyone help me? I have been trying to resolve this problem for weeks. Although the configuration log changed when I ended up rebuilding both the Splunk and the FMC server. The eStreamer encore app always shows disabled. I have checked /opt/splunk/etc/TA=eStreamer/bin/encore and the configuration log shows: Splencore not running Error outputting keys and certificates with the following errors digitial envelope routines:FIPS_CIPHERINIT: disabled for fips:fips_enc.c:142 digitial envelope routines:EVP_PBE_CipherInit:keygen failure:evp_pbe.c:197 PKCS12 routines:12_pbe_crypt:pkcs12 algor cipherinit error:p12_decr.c:87 PKCS12 routines:PKCSS12_item_decrypt_d2i:pkcs12 pbe crypt error:p12_decr.c:138 The estreamer log has the error: EncoreException: Uable to read password from console. Are you running as a background process? I get the same errors whether I use a password or not for the certificate I download from the Firepower Management Center.

molinarf · ‎05-01-2018

There was no answer to this and I am having a similar problem. In the /opt/splunk/etc/apps/TA-eStreamer/bin/encore there are two conf files. The first is default.conf and the second is estreamer.conf. In the file estreamer.conf, I made sure that the server information under subcription which is at the bottom of the file. I entered a valid IP for the line "host": "1.2.3.4" and a valid pkcsFilepath to where the client.pkcs12 certificate it is. I still had problems with the estreamer being stopped. The default one has the same information and I can't get the estreamer to start. So I input the same information into the default.conf and estreamer still isn't working. I hope someone has an answer to this problem.

molinarf · ‎03-05-2018

I was just alerted that a nessus scan came up with the same 'vulnerability'. I would think that the splunkd port 8089 is required on a server running the universal forwarder but I could be wrong. Is closing the port the only way since it would be best to use the server cert for communications? If you are using port 8089 to deploy apps and such, then wouldn't that cause problems. I think each host having it's own certificate would become somewhat of a monster issue when it comes time for renewing the certs.

molinarf · ‎11-08-2017

Are you looking to get data from your firewall for security events? If this is the case, you will need to install the Splunk for Cisco Security App which will provide a dashboard that contains Security Event Statistics, as well as being able to look at a Firewall Overview or Event Search.

molinarf · ‎09-27-2017

When I upgraded to version 7.0.0, the installation process created a new users.ini file. There is no issue now.

molinarf · ‎09-27-2017

I have been getting a message that says that a file has been improperly modified or missing. The result of the integrity check says that that file that failed is users.ini that is located in /etc/users. Upon inspection of the folder the users.ini file is named users.ini.pre405 and its size is 0KB. This doesn't prevent Splunk from working, but just more of an annoyance right now. Can anyone help me with resolving this issue? Thank you in advance. Configuration: Splunk 6.6.3 Windows 2012 R2 16 CPU Cores/32 Virtual CPU Cores 256 GB Memory 3TB disk space

molinarf · ‎08-25-2017

I believe the bottom line is that the resources need to be there on the indexer so that there are minimal to no skips on searches. The ideal Splunk configuration is that you have an indexer and a search head. The search head does what it does and if there are enough resources there would be no skipping searches. This way the load is kept separate. So if you have an indexer/search head on one server, there needs to be a lot of resources as it is searches per physical core, not virtual and the more you have with more memory then the probability of skipped searches go down. If that is not the case, and there is no way around the physical cpu and memory issues, then what I have found is that you can modify the limits.conf file. It is not something that Splunk support recommends, but it helps. Here are the places that I have changed: [scheduler] max_searches_perc = 50 (default) max_searches_per_cpu = 1 (default) I changed the max_searches_perc to 60 and max_searches_per_cpu to 10 to see if the skipping searches would go back to 0.00%. When it did I slowly lowered it down until I found a good point where there may be a small percentage skipped or none at all. I also changed the max_searches_perc back down to 50 at that point and watched it. With all the apps that I have and what I need it to do,Right now the max searches per cpu is at 5. I am good with that. I may have to go to getting another server for a search head. I hope this helps.

molinarf · ‎07-26-2017

I am currently trying to use Splunk to parse data from our Active Directory. I have currently loaded the Apps: Splunk Add-on for Microsoft Active Directory 2.1.4 Splunk Supporting Add-On for Active Directory 1.0.0 Splunk Add-on for Microsoft DNS 1.0.1 Splunk Add-on for Windows infrastructure 1.4.1 Splunk Add-on for Microsoft Windows 4.8.4 What I am struggling with since there is no clear instruction set is how to get the data that is relevant to Active Directory. I have only been able to find Splunk® App for Active Directory (Legacy) documentation. Does any one have ideas to help me get the last few steps into providing this type of data for my customer? Running: Windows Server 2012 R2 16 Cores (Physical) 32 Cores (Virtual) 262 GB memory Splunk 6.6.2

molinarf · ‎07-24-2017

The Cisco Security Suite App is generating 80% of the accelerated searches that is creating the skipped searches.

molinarf · ‎07-24-2017

the problem was with the McAfee log collection. Disabling that collection cleared the problem.

molinarf · ‎07-24-2017

I found the fix to the problem. The universal forwarder service was using a domain account. I changed it to using the local admin account for Splunk and it has not had any problems. The best solution is to install using the domain account,then after the universal forwarder is installed change it to use the local Splunk admin account.

molinarf · ‎06-21-2017

I looked at the License Usage report for the previous 30 days. Yesterday showed a huge increase and it is in the WinEventLog:Security that pushed it over the edge. When I look at it the host server for Splunk was generating the bulk of it at least from what I could tell. I am not sure it is a local performance monitoring or Local event log collection. I did change the local event log collection to exclude McAfee. Hopefully it fixes the problem. Thanks for the direction, I'll let you know how it goes.

molinarf · ‎06-21-2017

There was a license violation because the auto_generated_pool-enterprise had gone over the license of 1GB indexing. For the last month, the indexing volume ranged from .159 to .53. This morning sometime the indexing volume jumped to 1.12 GB. I am trying to determine what caused the sudden jump as now it is back to .16. In the event itself the type was a Rollover Summary. I am not really sure where to start looking for the answer. Configuration: Windows 2012 R2 Splunk 6.6.1 Single indexer which is the license master

molinarf · ‎06-08-2017

I am running Splunk Enterprise on a Windows Server 2012 R2 and have installed both the Splunk Universal Forwarder 6.5.3 and 6.6.1on Windows 10 workstations. I have noticed that after about a week after being installed, the SplunkForwarder Service stops. When I try to start the service, it says that it cannot start because of a logon problem. I found that I have to open the service properties and re-enter the password for the account that it uses. Once I enter the password, I am able to start the service. I have noticed that this happens on a few workstations and sometimes when it is installed on a server. I installed the universal forwarder with using a domain service account. Any ideas? I have chosen to uninstall the UF to see if there was a problem with installation, but I have found that it still occurs.

molinarf · ‎05-11-2017

You're right, my last instance of Splunk was on a server that had less resources and I never noticed this. Since I use it to monitor the security of my network, there may be a lot of real time searches going on, which I don't see. Of course, this is the first time I am using health check because it is 6.6 and I didn't notice it on 6.5.3. I'll check with Splunk PS to see if I messed something up by making those changes.

molinarf · ‎05-11-2017

Correction to my changes to the limits.conf file. [scheduler]max_searches_per cpu was changed to 15, not 25.

molinarf · ‎05-11-2017

After running the search you provided, here is what is returned. app: Splunk_CiscoSecuritySuite search_type: report_acceleration reason: The maximum number of concurrent auto-summarization searches on this instance has bee reached reason: The maximum number of concurrent historical scheduled searches on this instance has been reached The first one for the last 24hours has a count of 173834 and the second is 27. I updated the [scheduler]max_searches_per cpu to 25 and max_searches_perc from 50 to 60. Thanks,

molinarf · ‎05-11-2017

When I do a health check I get a warning that the skip ratio for scheduled searches is 96.4%. Upon further digging, and checking Search Activity: Instance it shows a skip ratio of 96.3 %. I have run the search index=_internal source=*scheduler.log | stats count by user, app, savedsearch_name, status and the results returned was a high number of scheduled searches from the app Cisco Security Suite that were skipped. I changed the [scheduler]max_searches_per cpu in the limits.conf file to 35. Is there anything else that I can do? Indexer Server CPU: 16 Physical 32 Virtual Memory: 262 GB

molinarf · ‎05-11-2017

Thanks MuS. I was beginning to wonder why all my searches kept bringing up references to unix. I think it might be worth it to open a bug report for future installers of Splunk on Windows servers.

molinarf · ‎05-10-2017

I run health check on my Splunk Enterprise 6.6.0 server running on Windows 2012 R2. I end up with the warning "One or more Splunk instances are running on a host that has on or more resource limits set below official recommendations." This is related to ulimits.data_segment_size being unknown. I have spent hours looking for which file the configuration is set, but I cannot find it. Can anyone point me to where I can modify the configurations? Thank you,

molinarf · ‎04-25-2017

Taking it a little further. I made sure the source interface was correct. Due to another problem for a server vlan, It was discovered that a wrong gateway IP was put in for the server vlan. Made correction and then rebuilt the firewall rules to use IP addresses instead of network objects. Once the IP route was corrected, and the rules input using IP addresses everything started working as it should. Thank you for your help and input. It helped me to determine where the problems may have been.

molinarf · ‎04-25-2017

Yes, I agree with you on routing being the issue. I can ping the management IP of the syslog server, but not the data IP. I have set a logging interface which doesn't seem to make a difference. I will have to do the show ip route with longer prefixes. I don't use VRF names. I will post what I get from the show ip route command. I am also going to try working exclusively with the management IP to see if I can get it to work. Thank you,

molinarf · ‎04-25-2017

Syslog input is set for UDP 514. That is one of the first things I did when I configured the Splunk Server. Thanks for you input.

molinarf · ‎04-24-2017

I have not been getting syslog info from a Cisco router. I have three switches sending syslog data to udp port 514 which can be viewed on Splunk. There is a Cisco firewall between the router and the Splunk server. I have done packet tracer on the firewall and the ports are showing open on the rules. Here is the physical setup: Cisco 2941<-->Cisco 5510<-->Cisco 4503<--> Splunk The error that I have been getting when I do a show log on the Cisco 2941 is "Unable to setup connection with host X.X.X.103 port 514. My Splunk Server" Windows 2012 R2 16 cores 256 GB RAM Splunk installed on D:/ partition Any assistance will be greatly appreciated. Thank you in advance.

Posts	92
Solutions	2
Karma Given	2
Karma Received	11
Member Since	‎07-08-2014

Online Status	Offline
Date Last Visited	‎04-05-2022 10:27 AM

Decommission A Site: How to change single site clu...

How to install Splunk Universal Forwarder on a Lin...

IOSTAT.sh script modification help

Create Server Class in Forwarder Management for Wi...

Cisco eStreamer eNcore issues

ImportError: No module named arparse

Splunk eStreamer eNcore client doesn't start

eStreamer for Splunk error outputting keys and cer...

missing users.ini file

Splunk and Active Directory

Splunk eStreamer eNcore client doesn't start

eStreamer for Splunk error outputting keys and cer...

Re: Cisco eStreamer eNcore for Splunk: Status Cont...

Re: Changing the Certificates for Universal forwar...

Re: Not able to see the syslogs of ASA on Splunk W...

Re: missing users.ini file

missing users.ini file

Re: Why is there a high Skip Ratio showing in Sche...

Splunk and Active Directory

Re: Why is there a high Skip Ratio showing in Sche...

Re: 6.6.1 License Violation due to auto_generated_...

Re: Splunk Universal Forwarder 6.5.3 installed on ...

Re: 6.6.1 License Violation due to auto_generated_...

6.6.1 License Violation due to auto_generated_pool...

Splunk Universal Forwarder 6.5.3 installed on Wind...

Re: Why is there a high Skip Ratio showing in Sche...

Re: Why is there a high Skip Ratio showing in Sche...

Re: Why is there a high Skip Ratio showing in Sche...

Why is there a high Skip Ratio showing in Schedule...

Re: Where is the correct configuration file locate...

Where is the correct configuration file located in...

Re: Why don't I receive syslog messages from a cis...

Re: Why don't I receive syslog messages from a cis...

Re: Why don't I receive syslog messages from a cis...

Why don't I receive syslog messages from a cisco r...

Join the Conversation