have enabled SSLv3 on splunk 4.2.1 index server and universalforwarder 4.2.1, universalforwarder doesn't seem to be able to communicate to the index server. please advise what can i do?
On Universalforwarder 4.2.1's splunkd.log:
05-05-2011 07:07:53.276 -0400 INFO TcpOutputProc - Connection to xx.xx.xx.xx:8089 closed. Read error. Connection reset by peer
05-05-2011 07:07:53.282 -0400 INFO TcpOutputProc - Connected to idx=xx.xx.xx.xx:8089
On Splunk Index server 4.2.1's splunkd.log:
05-05-2011 07:23:12.649 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:xxxxx, IP:yy.yy.yy.yy, PORT:54521
05-05-2011 07:23:12.650 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:xxxxx, IP:yy.yy.yy.yy, PORT:54525
I'm a bit confused. What is the Universal Forwarder trying to talk to the Indexer on 8089 for? 8089 is the port used for Splunk program level communication (such as license server traffic, etc). The forwarder should be sending to the indexer on a standard port that the indexer is configured to listen on, by default port 9997.
oh gosh. tmeader, you are right.
i think it is this command that is the culprit:
~/bin/splunk add forward-server xx.xx.xx.xx:9997
it writes into this file: ~/etc/system/local/outputs.conf
to contain
[tcpout]
defaultGroup = xx.xx.xx.xx_9997
disabled = false
[tcpout:xx.xx.xx.xx_9997]
server = xx.xx.xx.xx:9997
[tcpout-server://xx.xx.xx.xx:9997]
i have to manually change it to:
[tcpout]
disabled = false
indexAndForward = 0
I'm a bit confused. What is the Universal Forwarder trying to talk to the Indexer on 8089 for? 8089 is the port used for Splunk program level communication (such as license server traffic, etc). The forwarder should be sending to the indexer on a standard port that the indexer is configured to listen on, by default port 9997.
Can you post your relevant configs? (outputs.conf from UF, inputs.conf from Indexer)