Getting Data In

After installing a new UF, why is it not forwarding logs to the Indexers?

u2s1e0n2
New Member
05-10-2018 15:13:13.954 +0000 ERROR TcpOutputProc - Error initializing SSL context - invalid sslCertPath for server 45.125.XXX.X:9997
05-10-2018 15:13:13.959 +0000 ERROR SSLCommon - Can't read key file /opt/splunkforwarder/etc/auth/server.pem errno=151429224 error:0906A068:PEM routines:PEM_do_header:bad password read.

I just installed a new UF but it's not forwarding logs to the Indexers and the $SPLUNKHOME /var/log/splunk/splunkd.log shows the error message above. The IP in the error message is that of the Indexer: It is connecting to the Deployment Server and getting configs but not sending logs to the Indexers.
I need help understanding what is happening. I have reinstalled the UF but still got the same error messages.

The certs are default Splunk certs

Thanks

0 Karma

xpac
SplunkTrust
SplunkTrust

Please check if /opt/splunkforwarder/etc/auth/server.pem exists and can be read by the user Splunk runs at it. Have you modified it, or the password used for it? Does your outputs.conf contain a special sslCertPath settings for your indexers? If yes, check that file too.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...