由于凭据包重复，通用转发器无法将数据发送到Splunk云

适用范围

描述

以下错误消息在TcpInputProc组件下的索引器日志中可用：

ERROR TcpInputProc - Error encountered for connection from 
src=xxx.xxx.xxx.xxx:99999. error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

在通用转发器中，以下消息位于splunkd.log中，确认实例之间可以建立TCP连接：

INFO TcpOutputProc - Removing quarantine from idx=xxx.xxx.xxx.xxx:9997ERROR TcpOutputFd - Read error. Connection reset by peerWARN TcpOutputProc - Applying quarantine to ip=xxx.xxx.xxx.xxx port=9997 _numberOfFailures=2WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output 
group splunkcloud has been blocked for 82150 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.ERROR TcpOutputProc - Processing server from outputs.conf: can't resolve a valid IP address 
for host="inputsN.<SplunkDeployment>.splunkcloud.com"

调查

outputs.conf使用凭证包后会看到以下情况，该凭证包似乎已正确配置：

[tcpout:splunkcloud]
compressed = false
server = inputs1.<SplunkDeployment>.splunkcloud.com:9997, inputs2.<SplunkDeployment>.splunkcloud.com:9997, 
inputs3.<SplunkDeployment>.splunkcloud.com:9997, inputs4.<SplunkDeployment>.splunkcloud.com:9997, 
inputs5.<SplunkDeployment>.splunkcloud.com:9997, inputs6.<SplunkDeployment>.splunkcloud.com:9997, 
inputs7.<SplunkDeployment>.splunkcloud.com:9997, inputs8.<SplunkDeployment>.splunkcloud.com:9997
sslCertPath = $SPLUNK_HOME/etc/apps/100_splunk_splunkcloud/default/splunk_server.pem
sslCommonNameToCheck = *.<SplunkDeployment>.splunkcloud.com
sslPassword = DIAG_REDACTED_ENCRYPTED_PASSWORD
sslRootCAPath = $SPLUNK_HOME/etc/apps/100_splunk_splunkcloud/default/splunk_cacert.pem
sslVerifyServerCert = true etc/apps/100_splunk_splunkcloud/default/outputs.conf 
useClientSSLCompression = true

以下消息也在splunkd.log上，尝试对（100_<SplunkDeployment>_splunkcloud应用）进行身份验证，即使知道到server.pem的路径正确无误。

ERROR SSLCommon - Can't read key file /opt/splunk/etc/apps/100_splunk_splunkcloud/default/<SplunkDeployment>_server.pem errno=151404653 error:0906406D:PEM routines:PEM_def_callback:problems getting password.

分辨率

通用转发器上无法连接到Splunk云的错误似乎是由未正确配置凭据包导致的。

要解决此问题，应将凭据包推送到实例。将新包放置在部署服务器中并推送到实例，请勿在部署服务器中安装凭据包。

也可以按照以下步骤单独安装凭据包：
1)登录Splunk云部署
2)下载Splunk Universal Forwarder for Linux。
3)安装Splunk Universal Forwarder for Linux。
4)下载并安装通用转发器凭证。

安装和配置Splunk云平台通用转发器凭证包

由于证书密码无效，端口9997无法打开，因此断定凭证包SPL在另一个转发器中重复使用两次，对密码进行散列，现在索引器无法识别新的转发器。