Getting Data In

NetFlow Integrator 3.1.0 with splunk 5.0.2 can't start

popo80
New Member

Hello,

I'm new in splunk. Splunk with syslog works correct now. I try test netflow from cisco asa. I set netflow integrator on port 9995 and i set data source in splunk for udp on port 11514 source type netflow but netflow integrator not start:

NetFlow Integrator Server Status
NetFlow Integrator is not running.

i see in log:
/opt/splunk/etc/apps/netflow/logs # tail -f netflow_controller.log

2013-02-18 17:47:21,102 INFO Start server
2013-02-18 17:47:21,103 DEBUG Set lock!
2013-02-18 17:47:28,191 DEBUG Remove lock!
2013-02-18 17:47:28,227 DEBUG NetFlow Integrator is not running.

i tried start from cli:

/opt/splunk/etc/apps/netflow/bin/flowintegrator_linux64/bin # ./flowintegrator start
Starting Controller...
Starting NetFlow Integrator server...
but i get in logs:
tail -f server.log
2013-02-18 17:47:23 Starting server...
VERSION: 1.4.1.1.16
2013-02-18 17:48:11 Starting server...
VERSION: 1.4.1.1.16

i see also in logs:

tail -f nfc_server.2013-02-18.17_52_11.00.log
02-18 17:52:11.651 VERSION: 1.4.1.1.16
02-18 17:52:11.652 NETCONN: CONNECT to 127.0.0.1:20047 failed: 111
02-18 17:52:11.652 CONN SEND: failed to establish TCP/IP connection
02-18 17:52:11.652 CONN SR: send failed: 5 (attempt: 1)
02-18 17:52:11.674 NETCONN: gethostbyname() failed
02-18 17:52:11.674 Mgmt: receive failed: 107
02-18 17:52:11.674 Mgmt thread: exiting: 5
02-18 17:52:12.653 NETCONN: CONNECT to 127.0.0.1:20047 failed: 111
02-18 17:52:12.653 CONN SEND: failed to establish TCP/IP connection
02-18 17:52:12.653 CONN SR: send failed: 5 (attempt: 2)
02-18 17:52:13.653 NETCONN: CONNECT to 127.0.0.1:20047 failed: 111
02-18 17:52:13.653 CONN SEND: failed to establish TCP/IP connection
02-18 17:52:13.653 CONN SR: send failed: 5 (attempt: 3)

I'm stuck, thanks for help or any cue how to debug further..

thanks,
pop

Tags (2)
0 Karma

NetFlow_Logic
Contributor

Please make sure that the host has a proper FQDN in /etc/hosts. If this does not solve the issue, please submit a ticket at https://netflowlogic.zendesk.com/home

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...