- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Universal Forwarder - Repeating message TcpOut...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Universal Forwarder - Repeating message TcpOutputProc - Found currently active indexer...
I am getting the following messages on my forwarder running on Windows 10:
04-06-2020 18:05:52.171 -0700 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.218.6:9997, reuse=1.
04-06-2020 18:06:22.093 -0700 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.218.6:9997, reuse=1.
04-06-2020 18:06:51.934 -0700 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.218.6:9997, reuse=1.
04-06-2020 18:07:21.808 -0700 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.218.6:9997, reuse=1.
04-06-2020 18:07:51.660 -0700 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.218.6:9997, reuse=1.
I just updated the forwarder to 8.0.3 and these messages just keep coming. There are no disconnect messages, just these found messages.
HELP...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@dlpco Try downgrading the UF to version 8.0.1. It solved my problems. I also noticed, that all the logs were not transported to the indexer during the error messages. With UF v. 8.0.1 normal operation was resumed.
Br, Petri
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I noticed by accident I also had this problem, and it all started when I upgraded the Universal Forwaders to version 8.1.0. Now I downgraded all UFs back to version 8.0.1 and the problems disappeared. The Indexer version was originally when the problems started to appear 8.1.0, and right now it is 8.1.0.1.
For me this was not only an annoyance. I first found the problem, when I realized some logs were not transferred to the indexer. Some trouble shooting took me to the UF version issue. In my opinion this is clearly a bug, and it should be fixed.
Best regards,
Petri
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Those entries are normal and indicate successful connection between forwarder and indexer. Nothing to be concerned about, the opposite actually.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i got the same message, but in the splunk i don't find any logs.
What is the problem ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I also get these messages, 410.000 times in 4 hours and splunkd is the most indexed data type when I look in the monitoring console.
Is this normal? (I have around 800 forwarders in total)
/Daniel
Join Us for Splunk University and Get Your Bootcamp Game On!
.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!
Announcing Scheduled Export GA for Dashboard Studio
