由於憑據包重複，通用轉發器無法將資料傳送到Splunk雲

適用性

說明

在TcpInputProc元件下的索引器日誌中，以下錯誤消息可用：

ERROR TcpInputProc - Error encountered for connection from 
src=xxx.xxx.xxx.xxx:99999. error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

在通用轉發器中，以下消息位於splunkd.log中，確認例項之間可以建立TCP連線：

INFO TcpOutputProc - Removing quarantine from idx=xxx.xxx.xxx.xxx:9997ERROR TcpOutputFd - Read error. Connection reset by peerWARN TcpOutputProc - Applying quarantine to ip=xxx.xxx.xxx.xxx port=9997 _numberOfFailures=2WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output 
group splunkcloud has been blocked for 82150 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.ERROR TcpOutputProc - Processing server from outputs.conf: can't resolve a valid IP address 
for host="inputsN.<SplunkDeployment>.splunkcloud.com"

調查

outputs.conf使用憑據包後會顯示以下情況，該憑據包似乎已正確配置：

[tcpout:splunkcloud]
compressed = false
server = inputs1.<SplunkDeployment>.splunkcloud.com:9997, inputs2.<SplunkDeployment>.splunkcloud.com:9997, 
inputs3.<SplunkDeployment>.splunkcloud.com:9997, inputs4.<SplunkDeployment>.splunkcloud.com:9997, 
inputs5.<SplunkDeployment>.splunkcloud.com:9997, inputs6.<SplunkDeployment>.splunkcloud.com:9997, 
inputs7.<SplunkDeployment>.splunkcloud.com:9997, inputs8.<SplunkDeployment>.splunkcloud.com:9997
sslCertPath = $SPLUNK_HOME/etc/apps/100_splunk_splunkcloud/default/splunk_server.pem
sslCommonNameToCheck = *.<SplunkDeployment>.splunkcloud.com
sslPassword = DIAG_REDACTED_ENCRYPTED_PASSWORD
sslRootCAPath = $SPLUNK_HOME/etc/apps/100_splunk_splunkcloud/default/splunk_cacert.pem
sslVerifyServerCert = true etc/apps/100_splunk_splunkcloud/default/outputs.conf 
useClientSSLCompression = true

以下消息也在splunkd.log上，試圖對（100_<SplunkDeployment>_splunkcloud應用）進行身份驗證，即使知道指向server.pem的路徑正確無誤。

ERROR SSLCommon - Can't read key file /opt/splunk/etc/apps/100_splunk_splunkcloud/default/<SplunkDeployment>_server.pem errno=151404653 error:0906406D:PEM routines:PEM_def_callback:problems getting password.

解析

無法連線到Splunk Cloud的通用轉發器上的錯誤似乎是由未正確配置憑據包導致的。

要解決此問題，應將憑據包推入例項。將新包放置在部署伺服器中並推送到例項，請勿在部署伺服器中安裝憑據包。

還可以按照以下步驟單獨安裝憑據包：
1)登入Splunk雲部署
2)下載Splunk Universal Forwarder for Linux。
3)安裝Splunk Universal Forwarder for Linux。
4)下載並安裝通用轉發器憑據。

安裝和配置Splunk雲平台通用轉發器憑證包

由於證書密碼無效，埠9997無法開啟，因此斷定憑證包SPL在另一個轉發器中被重複使用兩次雜湊密碼，現在索引器無法識別新的轉發器。