Deployment Architecture

Installing Splunk Universal Forwarder - Error

mchopra
New Member

Hi
I have installed Splunk Universal Forwarder to send messages to an indexer (version 5.0.1). The messages are being sent, but we see the following errors in our log files.

Forwarder Logs
10-18-2016 11:16:40.000 +1100 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-18-2016 11:16:43.850 +1100 WARN HttpPubSubConnection - HTTP client error in http pubsub Connection closed by peer uri=http://10.90.XX.XXX:8087/services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087/XXXXXXXX/b0310...
10-18-2016 11:16:43.850 +1100 WARN HttpPubSubConnection - Unable to parse message from PubSubSvr:
10-18-2016 11:16:43.850 +1100 INFO HttpPubSubConnection - Could not obtain connection, will retry after=81.907 seconds.
10-18-2016 11:16:52.001 +1100 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

Server Logs

10-18-2016 11:04:23.854 +1100 ERROR TcpInputProc - Received unrecognized signature POST /services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087/XXXXXXX/b03109c2bad4/aix-power/8089/6.4.0/E83BB6F5-448D-491D-8F9E-D497760D6087/universal_forwarder/XXXXXXX HTTP/1.1\r\nUser-Agent: Splunk/6.4.3 (AIX 6.1; arch=4C)\r\nTE: trailers, chunked\r\nHost: 10.90.16.165:8087\r\nContent-Length: 0\r\nx-splunk-lm-nonce: b68e75b9f1d802a8be9da54499c6edd5\r\nx-splunk-lm-timestamp: 1476749063\r\nx-splunk-l! from src=10.3.1.46:52227

Thanks
Manish

Tags (1)
0 Karma

ddrillic
Ultra Champion
0 Karma

mchopra
New Member

This issue is different as the client machine can connect to the server machine. I have tested that as under

wget -p http://10.90.XX.XXX:8087/services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087/
--08:58:03-- http://10.90.XX.XXX5:8087/services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087/
=> `10.90.XX.XXX:8087/services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087/index.html'
Connecting to 10.90.XX.XXX5:8087... connected.
HTTP request sent, awaiting response...

Also I can see the server logs with the error as posted above
ERROR TcpInputProc - Received unrecognized signature POST /services/broker/connect/E83BB6F5-448D-491D-8F9E-D497760D6087...........

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...