All Apps and Add-ons

Cisco eStreamer Flow Logs work little time and stop

kalya
Explorer

Hi everybody!
I have new install Splunk 6.6.1 and Cisco eStreamer for Splunk 2.2.2 on CentOS (Ubuntu also tried).
Cisco Firepower Management Center 6.2.0.1 (build 59) is as source of logs.
I see that FILELOG MALWARE EVENT and FILELOG EVENT receive correct. But Flow Logs stopped receive after approximately one minute. After reboot Splunk server it's receive little portion of Flow Logs and stop again. No any problem in estreamer_debug.log

Jun 07 14:42:49 [1820] Setting up auth certificate
SFPkcs12 : Processing /opt/splunk/etc/apps/eStreamer/bin/X.X.X.X_12.pkcs12
SFPkcs12 : Writing ./server.crt
SFPkcs12 : Writing ./server.key
Jun 07 14:42:49 [1820] Retrieving metadata from file ./metadata.dat
Jun 07 14:42:49 [1820] Migrating prior version bookmark (if necessary)
Jun 07 14:42:49 [1820] Starting processing for other
Jun 07 14:42:49 [1822] Starting processing for rna
Jun 07 14:42:49 [1820] Building connection parameters for all other events
Jun 07 14:42:49 [1822] Building connection parameters for RNA
Jun 07 14:42:49 [1820] Connecting to X.X.X.X port 8302
Jun 07 14:42:49 [1822] Connecting to X.X.X.X port 8302
Jun 07 14:42:49 [1822] Starting bookmark is 1496823640
Jun 07 14:42:49 [1822] Requesting Event Stream
Jun 07 14:42:49 [1822] Entering Event Loop
Jun 07 14:42:50 [1820] Starting bookmark is 1496835598
Jun 07 14:42:50 [1820] Requesting Event Stream
Jun 07 14:42:50 [1820] Entering Event Loop
Jun 07 14:43:20 [1820] Waiting for more logs
Jun 07 14:43:21 [1822] Waiting for more logs
Jun 07 14:43:50 [1820] Waiting for more logs

estreamer.conf
[estreamer]
changed = 0
client_disabled = 0
log_flows = 1
watch = 1
debug = 1

Labels (2)

asalimkumar
New Member

Hello ,

We are also facing the same error in our configuration. I tried to change the configuration to disable batch size, however configuration is not getting accepted in splunk.

I have added the parameter to the end of estreamer.conf file right before the last }.

Any body had this issue resolved ? please guide me if possible

Best Regards,
Aneesh Salimkumar

0 Karma

salsunda
New Member

Hi Aneesh,

Please use the Line next.,

cat estreamer.conf
{
"batchSize": 1,

Regards,
Salai

0 Karma

aakwah
Builder

I had a similar issue but with a newer version, at the end it turned out to be that there is a parameter in estreamer.conf called batchsize, to control the size of log batches sent to indexers, so if you have intrusion events enabled and batchsize is set to 100, then you have to wait until you have 100 intrusions events to see them on Splunk :).

to disable this feature:
"batchSize": 1

ref.
https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreSpl...

0 Karma

douglashurd
Builder

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

0 Karma

kyrector
New Member

Are you hitting this bug?

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCve44987

Known fixes include 6.2.0.2 or you can open a TAC case and get hotfix U if you're unable to upgrade for some reason.

I would strongly recommend upgrading though.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...