Hi
I have installed Splunk Universal Forwarder to send messages to an indexer (version 5.0.1). The messages are being sent, but we see the following errors in our log files.
Forwarder Logs
10-18-2016 11:16:40.000 +1100 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-18-2016 11:16:43.850 +1100 WARN HttpPubSubConnection - HTTP client error in http pubsub Connection closed by peer uri=http://10.90.XX.XXX:8087/services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087/XXXXXXXX/b03109c2bad4/aix-power/8089/6.4.0/E83BB6F5-448D-491D-8F9E-D497760D6087/universal_forwarder/XXXXXX
10-18-2016 11:16:43.850 +1100 WARN HttpPubSubConnection - Unable to parse message from PubSubSvr:
10-18-2016 11:16:43.850 +1100 INFO HttpPubSubConnection - Could not obtain connection, will retry after=81.907 seconds.
10-18-2016 11:16:52.001 +1100 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
Server Logs
10-18-2016 11:04:23.854 +1100 ERROR TcpInputProc - Received unrecognized signature POST /services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087/XXXXXXX/b03109c2bad4/aix-power/8089/6.4.0/E83BB6F5-448D-491D-8F9E-D497760D6087/universal_forwarder/XXXXXXX HTTP/1.1\r\nUser-Agent: Splunk/6.4.3 (AIX 6.1; arch=4C)\r\nTE: trailers, chunked\r\nHost: 10.90.16.165:8087\r\nContent-Length: 0\r\nx-splunk-lm-nonce: b68e75b9f1d802a8be9da54499c6edd5\r\nx-splunk-lm-timestamp: 1476749063\r\nx-splunk-l! from src=10.3.1.46:52227
Thanks
Manish
... View more