Getting Data In

how to troubleshoot connection issues from heavy forwarder to syslog receiver?

pavanae
Builder

I have a heavy forwarder in which I setup the outputs.conf as follows

[tcpout]
defaultGroup = indexer_group,forwarders_syslog
useACK = true

[tcpout:indexer_group]
server = indexer_ip_address:indexer:port
clientCert = xxxxxxxx
maxQueueSize = 20MB
sslPassword = xxxxxxxxx

[tcpout:forwarders_syslog]
server = syslog_ip:syslog_port
clientCert = xxxxxxx
maxQueueSize = 20MB
sslPassword = xxxxxxxx
blockOnCloning = false
dropClonedEventsOnQueueFull = 10
useACK = false

Now the heavyforwarder is forwarding logs to indexer_group successfully but I am seeing the following errors on splunkd.log when the heavy forwarder trying to forward the logs to syslog server

WARN  TcpOutputProc - Cooked connection to ip=syslog_ip:syslog_port timed out
ERROR TcpOutputFd - Connection to host=syslog_ip:syslog_port failed
WARN  TcpOutputFd - Connect to syslog_ip:syslog_port  failed. Connection refused

Now what are the troubleshooting steps to identify the root cause. Is there any why to check in usnix server whether the heavy forwarder is able to send to receiver on a specific port?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

"Connection refused" indicates this could be a networking/firewall problem. Use your favorite tool (NOT ping) to verify the HF can connect to the syslog IP:port.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...