Refine your search:

Hoping someone can help me out here:

I have a system with a heavy forwarder installed (v.4.1.6) that shows the following event repeatedly (at last count 150k+)

10-06-2011 17:56:33.846 WARN  TcpOutputProc - The event is missing source information. Event :

I think it has something to do with a bad input the configurations are standardized an look correct. I have also reinstalled the splunk package with no luck. Connectivity between the client and the indexer is OK ; I can port 9997 is open and clear.

Thanks!

asked 06 Oct '11, 11:11

Kate_Lawrence-Gupta's gravatar image

Kate_Lawrence-Gupta
288135
accept rate: 7%

edited 06 Oct '11, 16:03

dwaddle's gravatar image

dwaddle ♦
18.8k3938


2 Answers:

Kate - am not sure this may solve it - but have you checked that host's IP address and / or name are set up correctly? Probably a daft question if its a major server out there ;-)

link

answered 26 Sep '12, 06:01

DaveSavage's gravatar image

DaveSavage
43626
accept rate: 8%

I have observed same when in no particular order

1) hostname -f fails to return an FQDN 2) in /etc/hosts if the line containing the hostname / hostname w/ FQDN is of the format

IP SHORTNAME FQDN

when in point of fact it must be of the form

IP FQDN SHORTNAME

That's why hostname -f didn't work. Wrong ordering

suppose we have an /etc/hosts as follows

127.0.0.1 localhost localhost.localdomain
a.b.c.d   hostname hostname.domain

we can resolve as follows:

grep localhost /etc/hosts > /etc/hosts.correct
grep `hostname` /etc/hosts | awk '{print $1 " " $3 " " $2}' >> /etc/hosts.correct
\cp -p /etc/hosts /etc/hosts.broken
\cp -p /etc/hosts.correct /etc/hosts

Output of /etc/hosts

127.0.0.1 localhost localhost.localdomain
a.b.c.d   hostname.domain hostname
link

answered 23 May, 02:47

ncsantucci's gravatar image

ncsantucci
212
accept rate: 0%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×891
×118

Asked: 06 Oct '11, 11:11

Seen: 1,316 times

Last updated: 23 May, 02:47

Copyright © 2005-2014 Splunk Inc. All rights reserved.