Getting Data In

universalforwarder 4.2.1 unable to connect to index server 4.2.1 with sslv3

deyeo
Path Finder

have enabled SSLv3 on splunk 4.2.1 index server and universalforwarder 4.2.1, universalforwarder doesn't seem to be able to communicate to the index server. please advise what can i do?

On Universalforwarder 4.2.1's splunkd.log:

05-05-2011 07:07:53.276 -0400 INFO  TcpOutputProc - Connection to xx.xx.xx.xx:8089 closed. Read error. Connection reset by peer

05-05-2011 07:07:53.282 -0400 INFO  TcpOutputProc - Connected to idx=xx.xx.xx.xx:8089

On Splunk Index server 4.2.1's splunkd.log:

05-05-2011 07:23:12.649 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:xxxxx, IP:yy.yy.yy.yy, PORT:54521

05-05-2011 07:23:12.650 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:xxxxx, IP:yy.yy.yy.yy, PORT:54525
Tags (2)
0 Karma
1 Solution

tmeader
Contributor

I'm a bit confused. What is the Universal Forwarder trying to talk to the Indexer on 8089 for? 8089 is the port used for Splunk program level communication (such as license server traffic, etc). The forwarder should be sending to the indexer on a standard port that the indexer is configured to listen on, by default port 9997.

View solution in original post

deyeo
Path Finder

oh gosh. tmeader, you are right.

i think it is this command that is the culprit:

~/bin/splunk add forward-server xx.xx.xx.xx:9997

it writes into this file: ~/etc/system/local/outputs.conf
to contain

[tcpout]
defaultGroup = xx.xx.xx.xx_9997
disabled = false

[tcpout:xx.xx.xx.xx_9997]
server = xx.xx.xx.xx:9997

[tcpout-server://xx.xx.xx.xx:9997]

i have to manually change it to:

   [tcpout]
    disabled = false
    indexAndForward = 0
0 Karma

tmeader
Contributor

I'm a bit confused. What is the Universal Forwarder trying to talk to the Indexer on 8089 for? 8089 is the port used for Splunk program level communication (such as license server traffic, etc). The forwarder should be sending to the indexer on a standard port that the indexer is configured to listen on, by default port 9997.

ftk
Motivator

Can you post your relevant configs? (outputs.conf from UF, inputs.conf from Indexer)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...