Thanks for the reply nkoppert_s I forgot about mongod - no cert errors which is what I thought initially because the Akamai Logging Dasboard was spitting out cert errors. I fixed those and now we think we have a proxy exception issue. Currently trying to identify the IP that is opening and closing the connections! 2022-09-16T10:02:28.190Z I NETWORK [conn21] end connection X.X.X.115:50532 (12 connections now open) 2022-09-16T13:02:26.280Z I NETWORK [listener] connection accepted from X.X.X.119:63791 #22 (13 connections now open) 2022-09-16T13:02:26.843Z I NETWORK [conn22] end connection X.X.X.119:63791 (12 connections now open) 2022-09-16T13:03:21.013Z I NETWORK [listener] connection accepted from X.X.X.119:49161 #23 (13 connections now open) 2022-09-16T13:03:24.934Z I NETWORK [conn23] Error receiving request from client: ProtocolError: Client sent an HTTP request over a native MongoDB connection. Ending connection from X.X.X.119:49161 (connection id: 23) 2022-09-16T13:03:24.934Z I NETWORK [conn23] end connection X.X.X:49161 (12 connections now open) 2022-09-16T13:03:44.104Z I NETWORK [listener] connection accepted from X.X.X.119:50534 #24 (13 connections now open) 2022-09-16T13:03:44.457Z I NETWORK [conn24] Error receiving request from client: SSLHandshakeFailed: The server is configured to only allow SSL connections. Ending connection from X.X.X.119:50534 (connection id: 24) 2022-09-16T13:03:44.457Z I NETWORK [conn24] end connection X.X.X.119:50534 (12 connections now open) 2022-09-18T01:17:00.757Z I JOURNAL [journal writer] old journal file /opt/splunk/var/lib/splunk/kvstore/mongo/journal/j._0 will be reused as /opt/splunk/var/lib/splunk/kvstore/mongo/journal/prealloc.0 2022-09-19T17:43:37.541Z I JOURNAL [journal writer] old journal file /opt/splunk/var/lib/splunk/kvstore/mongo/journal/j._1 will be reused as /opt/splunk/var/lib/splunk/kvstore/mongo/journal/prealloc.0 2022-09-21T10:01:24.642Z I JOURNAL [journal writer] old journal file /opt/splunk/var/lib/splunk/kvstore/mongo/journal/j._2 will be reused as /opt/splunk/var/lib/splunk/kvstore/mongo/journal/prealloc.0 ... View more

Also getting the following ERROR; ERROR ExecProcessor - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:451) Any help appreciated! Mike ... View more

Hi javo_dig, Not having any luck with this Akamai SIEM Integration app. It spits out; ERROR ExecProcessor - message from "/opt/splunk/etc/apps/TA-Akamai_SIEM/linux_x86_64/bin/TA-Akamai_SIEM.sh" javax.xml.stream.XMLStreamException: No element was found to write: java.lang.ArrayIndexOutOfBoundsException: -1 How did you manage to make this app work? I have it on a Deployer for the SHC btw. the only don't find any inputs, only the Data Inputs I find is the Akamai SIEM API which I configured properly to the Akamai Control dashboard. Can you provide detailed steps please?   Mike aka deepdiver ... View more