I want to setup a universal forwarder that receive logs from a syslog server (share a volume) and send logs to a receiver.
For some reason I get the error below on my forwarder container:
*splunk-forwarder_1 | TASK
[splunk_universal_forwarder : Disable indexing on the current node] *******
splunk-forwarder_1 | fatal:> [localhost]: FAILED! =>> {"cache_control": "no-store, no-cache,> must-revalidate, max-age=0", "changed": false, "connection": "Close", "content": "\n\n \n \n In handler 'conf-outputs': Could not flush changes to disk: /nobody/system/outputs/indexAndForward/index:
ConfPathMapper: /opt/splunkforwarder/etc/system/local\n \n\n", "content_length": "279", "content_type": "text/xml; charset=UTF-8", "date": "Tue, 06 Aug 2019 08:23:31 GMT", "elapsed": 0, "expires": "Thu, 26 Oct 1978 00:00:00 GMT", "msg": "Status code was 500 and not [201, 409]: HTTP Error 500: Internal Server Error", "redirected":false, "server": "Splunkd", "status":500, "url":"https://127.0.0.1:8089/servicesNS/nobody/system/configs/conf-outputs","vary": "Cookie, Authorization","x_content_type_options": "nosniff", "x_frame_options": "SAMEORIGIN"}*
The outputs.conf on the forwarder:
[tcpout:splunkreceiver]
server=splunkreceiver:9997
**When I remove this file - the error is gone, so I guess the problem is in this file.**
My docker-compose.yml:
syslog-server:
build: './collector'
ports:
- '8081:8081'
volumes:
- syslog-logs:/var/log/syslog-ng
depends_on:
- splunk-forwarder
splunk-forwarder:
hostname: splunkuniversalforwarder
image : splunk/universalforwarder
ports:
- '8082:8082'
volumes:
- ./forwarder/inputs.conf:/opt/splunkforwarder/etc/system/local/inputs.conf
- ./forwarder/outputs.conf:/opt/splunkforwarder/etc/system/local/outputs.conf
- syslog-logs:/opt/splunkforwarder/var/log
env_file:
- ./forwarder/forwarder.env
depends_on:
- splunk-receiver
splunk-receiver:
hostname: splunkreceiver
image : splunk/splunk:latest
ports:
- '8083:8083'
env_file:
- ./receiver/receiver.env
volumes:
- ./receiver/inputs.conf:/opt/splunk/etc/system/local/inputs.conf
Any Ideas?
------------------
More files:
The inputs.conf on the forwarder:
[monitor:///opt/splunkforwarder/var/log]
index=my-index
sourcetype=my-source-type
disabled = 0
The inputs.conf on the receiver:
[splunktcp://9997]
disabled = 0
↧