Errors when trying to run eStreamer client "Can't locate Net/SSLeay.pm in @INC

[cburgman]

I am having issues getting the eStreamer client to start. I can run ./estreamer_client.pl -t -c /opt/splunk/etc/apps/eStreamer/local/estreamer.conf and get a successful connection. However, when it runs through the app I am getting:

event_sec=1500407272 status_id=-1 status="ERROR: Problems starting the eStreamer client (Can't locate Net/SSLeay.pm in @INC (@INC contains: /opt/splunk/etc/apps/eStreamer/bin/lib /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at /opt/splunk/etc/apps/eStreamer/bin/lib/IO/Socket/SSL.pm line 18.BEGIN failed--compilation aborted at /opt/splunk/etc/apps/eStreamer/bin/lib/IO/Socket/SSL.pm line 18.Compilation failed in require at /opt/splunk/etc/apps/eStreamer/bin/estreamer_client.pl line 72.BEGIN failed--compilation aborted at /opt/splunk/etc/apps/eStreamer/bin/estreamer_client.pl line 72.)"

I have worked with my Linux team to install the recommended modules and have validated that Net/SSLeay.pm exists under /usr/local/lib64/perl5

[root@splunksearch perl5]# ls -la /usr/local/lib64/perl5/Net/SSLeay.pm
-r--r--r-- 1 root root 52995 Mar 27 15:59 /usr/local/lib64/perl5/Net/SSLeay.pm

Here is the results of ./estreamer_client.pl -t -c /opt/splunk/etc/apps/eStreamer/local/estreamer.conf

Jul 18 14:45:22 [13495] Effective Config: $VAR1 = {
          'verbose' => '1',
          'test' => 1,
          'log_extra_data' => 0,
          'log_metadata' => '1',
          'domain' => 2,
          'watch' => '1',
          'pkcs12_password' => '',
          'server' => '10.x.x.x',
          'daemon' => undef,
          'log_users' => 0,
          'logfile' => undef,
          'ipv6' => undef,
          'port' => 8xxx,
          'log_flows' => '1',
          'pkcs12_file' => '/opt/splunk/etc/apps/eStreamer/bin/10.x.x.x.pkcs12',
          'config' => '/opt/splunk/etc/apps/eStreamer/local/estreamer.conf',
          'log_packets' => 0,
          'start' => 'bookmark'
        };

Jul 18 14:45:22 [13495] Setting up auth certificate
SFPkcs12 : Processing /opt/splunk/etc/apps/eStreamer/bin/10.x.x.x.pkcs12
SFPkcs12 : Writing ./server.crt
SFPkcs12 : Writing ./server.key
Jul 18 14:45:22 [13495] Retrieving metadata from file ./metadata.dat
Jul 18 14:45:22 [13495] Connecting to 10.x.x.x port 8xxx
Jul 18 14:45:22 [13495] Opening event stream
Jul 18 14:45:23 [13495] Closing the connection and event stream
Jul 18 14:45:23 [13495] Saving metadata to file ./metadata.dat
Jul 18 14:45:23 [13495] Testing complete, without errors.

Splunk Core 6.6.2
eStreamer Version 2.2.2, build 173

[douglashurd]

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.