Hi
I am having some issues configuring an Intermediate Forwarder (IF) in our environment. The intermediate Forwarder is installed using a Universal Forwarder (UF) as per the document:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Configureanintermediateforwarder. Basically a host has the Universal Forwarder installed with the following inputs.conf and ouputs.conf files within the system\local directory:
++++++++++++++++++++++++++++++++++++++++++
*******Inputs.conf*******
[splunktcp-ssl:9997]
disabled = 0
[SSL]
serverCert = Certificate
sslPassword = Password
requireClientCert = false
sslVersions = tls1.2
[tcpout]
defaultGroup = splunkindexer
disabled = false
++++++++++++++++++++++++++++++++++++++++++
***Outputs.conf***
[tcpout:splunkindexer]
server = server
clientCert = Certificate
sslPassword = Password
sslVerifyServerCert = false
sslVersions = tls1.2
++++++++++++++++++++++++++++++++++++++++++
The server acting as the IF sends its logs to the Indexer as I am able to see the server in the splunk console, however I get following error messages displayed within splunkd.log on the IF in the following configurations:
**sslVersions = tls1.2**
With the "sslVersions = tls1.2" configured in the inputs.conf on the receiving Indexer, the inputs.conf and outputs.conf on the IF and outputs.conf on the UFs forwarding the data to the IF, I get the following error:
**ERROR TcpInputProc - Error encountered for connection from src=:59393. error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number**
**sslVersions = ***
If the "sslVersions = *" value is configured on the inputs.conf on the receiving Indexer, the inputs.conf and outputs.conf on the IF and outputs.conf on the UFs forwarding the data to the IF, I get the following error:
**ERROR TcpInputProc - Error encountered for connection from src=:57719. error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol**
I have:
- re-entered the certificate password
and restarted the service
- Removed the
SSL config details from the
inputs.conf file on the IF and no data
gets forwarded
There are no problems with the configuration as displayed above if the outputs.conf file is configured as above on any other host forwarding its logs directly to the Indexer and the inputs.conf file is configured as above.
↧