Skip to main content

Stream

Ask and answer questions about routing, shaping, and optimizing observability and security data.

  • 282 Topics
  • 601 Replies
282 Topics
P
Peter SlavinskisNew Participant
asked in Stream
Connection error: Client network socket disconnected before secure TLS connection was established

Has anyone used a Transparent proxy when using Hybrid workers with CRIBL.Cloud ?We are having a weird issue where the workers work and communicate to CRIBL.Cloud Leader as expected but when the CRIBL.Cloud leader gets rebooted after an upgrade all the worker nodes get this error when trying to talk to the CRIBL.Cloud leader:Connection error: Client network socket disconnected before secure TLS connection was established

00
P
A
Adhithiyan RajendranNew Participant
asked in Stream
what's an alternate input plugin for logs received from beats

what's an alternate input plugin for logs received from beats

00
A
J
Jesse BosNew Participant
asked in Stream
Setting up Postgres Database Connection with Cyberark managed account

Hello. We are trying to set up a postgres database connection using cyberark (on prem).How would we build the connection string? Cribl expects the following format: postgres[ql]://[userspec@][hostspec][/dbname][?paramspec]But this doesn't seem to include any vault managed database user account.

00
J
A
ananya.girish@wipfli.comNew Participant
asked in Stream
I am not able to see the logs forwarded from the PaloAlto in the sentinel in the AUX Table format.

I am using Cribl to be able to send Palo Alto syslogs to a custom AUX table in Sentinel.I have configured the port for ingesting Syslog. The private IP address of the VM hosting Cribl is also set. Source is the syslog and the destination is the sentinel. Express route is taken to go to Routing and QuickConnect .The logs are forwarded from the PaloAlto firewall. But I am not able to filter them out in the AUX table in the sentinel. Although if I SSH into Cribl box and simulate some CEF over Syslog traffic with Logger, I am able to see it in the sentinel. I want to see the logs that is being forwarded from the PaloAlto Firewall. Use Cribl to ingest Firewall logs into Sentinel Auxiliary Logs tier | LinkedInI have used this document for the setup.

00
A
M
Mars WarriorNew Participant
asked in Stream
Unable to connect worker to leader (v4.9.3 & 4.10.0) in Docker. Git required??

I used to use an older version of Cribl that just worked using the supplied docker compose example.Now I upgraded to 4.9.3 (also tried 4.10.0) and nothing works anymore:I already changed the env vars from "Master" to "Leader" (tough change!)I also tried to disable gitops, CRIBL_GIT_OPS=noneHowever:Despite that none setting, the server complains about not having gitworkers cannot connect (ECONNREFUSED)I cannot get into the GUI (ECONNREFUSED)2025-02-25T11:52:09.860Z ERR boot failed, checking for rollback | cid=api channel=cribl reason={"message":"no versioning available","stack":"Error: no versioning available\n at new b (/opt/cribl/bin/cribl.js:15:7096923)\n at P.setupInheritance (/opt/cribl/bin/cribl.js:15:7619887)\n at /opt/cribl/bin/cribl.js:15:12733811"}2025-02-25T11:52:09.860Z ERR failed to start Cribl server, exiting... | cid=api channel=cribl reason={"message":"no versioning available","stack":"Error: no versioning available\n at new b (/opt/cribl/bin/cribl.js:15:7096923)\n

00
M
D
Dinesh_YashNew Participant
asked in Stream
Export feeds / sources configured on Cribl stream

Hey everyone,Currently, we have 200+ sources configured in Cribl Stream (Collectors / Push / Pull), collecting data from a wide variety of sources and forwarding it to different destinations such as Splunk, Exabeam, and S3.I’d like to extract a list of all configured sources (both enabled and disabled), along with their associated routes, pipelines, and destinations.Is there a way to achieve this within Cribl Stream?Thanks!

00
D
M
matthew.garrett@fnbhutch.bankNew Participant
asked in Stream
Difficulty pulling Cisco Umbrella logs from Amazon AWS into Cribl

I have verified that I can list the directories using the AWS CLI with the following command:aws s3 ls s3://cisco-managed-us-east-2/my_directory_prefix/I can pull the logs to my local directory using the following command:aws s3 sync s3://cisco-managed-us-east-2/my_directory_prefix/dnslogs/ C:\umbrella_logs\However, I am unable to pull them using the Umbrella S3 Collector in Cribl Stream locally hosted. Any ideas on what I could do differently?Here are my settings for the Cribl S3 collector with the personalized info redacted:{ "type": "collection", "ttl": "4h", "removeFields": [], "resumeOnBoot": false, "schedule": { "cronSchedule": "*/5 * * * *", "maxConcurrentRuns": 1, "skippable": true, "run": { "rescheduleDroppedTasks": true, "maxTaskReschedule": 1, "logLevel": "info", "jobTimeout": "0", "mode": "run", "timeRangeType": "relative", "timestampTimezone": "UTC", "timeWarning": {}, "expression": "true", "minTaskSize": "1MB", "maxTaskSize": "10MB" }, "enabled": false }, "streamtags": []

00
M

Badge winners

Show all badges
Terms & ConditionsCookie settings