I was able to successfully install the latest Sourcefire app (2.0) into my Splunk 4.3 environment. The app works for the most part but does not log or index any pcap data.
I have pcap enabled in eStreamer (Intrusion Event Packet Data) in the Sourcefire Defense Center and I have changed inputs.conf to read:
[script://$SPLUNK_HOME/etc/apps/Sourcefire/bin/estreamer_pcap.py]
disabled = false
interval = 0
source = estreamer_pcap.py
[monitor://$SPLUNK_HOME/etc/apps/Sourcefire/log/estreamer_pcap.log]
disabled = false
sourcetype = estreamer_pcap
I can see that estreamer_pcap.py is running every minute but estreamer_pcap.log is always empty.
INFO ExecProcessor - Ran script: python /usr/local/splunk/etc/apps/Sourcefire/bin/estreamer.py, took 79.97 milliseconds to run, 0 bytes read
I do see single packets getting written to /tmp/tmp.pcap and the following command successfully produces pcap data:
./ssl_test_pcap.pl x.x.x.x -o splunk_pcap -tshark=/usr/sbin/tshark -f test.pcap
However, I can't figure out why 'estreamer_pcap.log' is always empty. Any help or suggestions would be greatly appreciated.