Introducing SOC Insights for BloxOne Threat Defense: Boost your SOC efficiency with AI-driven insights to eliminate manual work and accelerate investigation and response times. Read the blog announcement here.

Reporting

Reply

Non-sensical error message

Expert
Posts: 185
6711     1

Just having a play in my lab, the reporting server is down and I'm getting this non-sensical error:

 

 

infoblox error.jpg

Paul Roberts
PCN (UK) Ltd

All opinions expressed are my own and not representative of PCN Inc./PCN (UK) Ltd. E&OE

Re: Non-sensical error message

[ Edited ]
Superuser
Posts: 81
6712     1

Hello Paul,

 

Sorry for this late reply. I’ll take your concern in two aspects & shall reply inline to both of them.

 

1) The grammatical error in the error that you see over there.

 

-> Infoblox would fix that grammatical error & change it to something like ‘Forwarder is running but it fails to connect to ANY of the indexers’. The tentative releases which shall include this change is 8.5.0/8.4.3 & later.

 

2) Is that error expected to be there, having the indexer removed from your Grid ?

 

-> That’s expected when the indexer is unavailable & a Splunk Forwarder instance is running on your Grid members. Infoblox added an enhancement to include the error, ‘Forwarder is running but it fails to connect to none of the indexers’ from NIOS version 8.x & later. A script regularly runs on the grid forwarder instances (non-reporting Grid members & grid master) to check for the message “ERROR TcpOutputFd - Connection to host=x.x.x.x:9997 failed” in its own splunkd.log file. The output of the above script is updated to a text file within the Splunk forwarder. If the output in the file mentioned above indicates that the connection to ALL the indexers has FAILed(Like in case we have a cluster setup), then the status ‘Forwarder is running but it fails to connect to NONE of the indexers’ is reported by that specific forwarder in the GUI.

 

Hope that’s helpful!

 

Best regards.

 

Showing results for 
Search instead for 
Did you mean: 

Recommended for You