We have upwards of 250k forwarders in one of our environments and various levels of DNS caching that make it very difficult for a forwarder to request a deployment server IP from a DNS name and maintain the connection consistently in order for it to get appropriate apps downloaded.  I have seen where a system will request an IP from a DNS name, make an initial connection to a deployment server, then send a DNS query again only to be given a different IP address, which causes issues with the forwarder trying to establish a consistent trusted connection to a deployment server.  That switch in deployment server destinations causes the forwarder to just try again later, until it can establish a consistent connection randomly. We put our deployment servers behind a load balancer before, but all the connections and logs show the forwarders coming from the same ip address.. something x-forwarded-for should help solve at our scale. ... View more

After discovering the event.log was binary-- but the file would seemingly load up fine in notepad, or notepad++.. I discovered the file was actually in a different character set called UCS-2 LE, which according to (http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Configurecharactersetencoding) maps to the utf-16le characterset- that I had to specify that in the props.conf on the forwarder. [monitor://C:ProgramDataMcAfeeHost Intrusion PreventionEvent.log] index= disabled = 0 sourcetype = hipsfw followTail = 1 in props.conf (still on forwarder) [hipsfw] NO_BINARY_CHECK = true CHARSET = utf-16le ... View more

After discovering the event.log was binary-- but the file would seemingly load up fine in notepad, or notepad++.. I discovered the file was actually in a different character set called UCS-2 LE, which according to (http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Configurecharactersetencoding) maps to the utf-16le characterset- that I had to specify that in the props.conf on the forwarder. [monitor://C:\ProgramData\McAfee\Host Intrusion Prevention\Event.log] index= disabled = 0 sourcetype = hipsfw followTail = 1 in props.conf (still on forwarder) [hipsfw] NO_BINARY_CHECK = true CHARSET = utf-16le This should get everyone going. ... View more

After discovering the event.log was binary-- but the file would seemingly load up fine in notepad, or notepad++.. I discovered the file was actually in a different character set called UCS-2 LE, which according to (http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Configurecharactersetencoding) maps to the utf-16le characterset- that I had to specify that in the props.conf on the forwarder. [monitor://C:\ProgramData\McAfee\Host Intrusion Prevention\Event.log] index= disabled = 0 sourcetype = hipsfw followTail = 1 in props.conf (still on forwarder) [hipsfw] NO_BINARY_CHECK = true CHARSET = utf-16le This should get everyone going. ... View more