Meisch Super Contributor.
Super Contributor.
545 views

Can I change the internal port for ESM for port 8089?

Our operations uses SPLUNK to operationally monitor our systems.  One of those systems is our ESM.  For SPLUNK to communicate between themselves, they use 8089 TCP.  In ESM, this is used for internal communications thus if a SPLUNK universal forwarder is installed and starts on boot, ESM comms between the DB an LOGGER services will fail and thus renders ESM useless.

I am sure we are not the only company out there that has SPLUNK and ESM and its in use side by side...  I am curious what the PROTECT 724 community has done.  Please let me know.

Logs, logs and more logs
Labels (3)
Tags (3)
0 Likes
5 Replies
Micro Focus Expert
Micro Focus Expert

Re: Can I change the internal port for ESM for port 8089?

Hi Christian,

Coincidentally this exact question was raised today here: (see comment on bottom of page).

Hopefully it will be addressed soon.

Thanks and best regards,

Lar

0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Can I change the internal port for ESM for port 8089?

Hey Christian,

one way to work around this is by modiying the splunk config so that the universal forwarder listens on the network address and not on localhost. That way ArcSight can listen on 127.0.0.1:8089 and Splunk can listen on <10.x.x.x>:8089.

Hope that helps

-Tobias

0 Likes
Meisch Super Contributor.
Super Contributor.

Re: Can I change the internal port for ESM for port 8089?

this does not have to be global but set on the system you want splunk to listen on the network address right?

Logs, logs and more logs
0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Can I change the internal port for ESM for port 8089?

Correct, it should be enough to modify the splunk agent on the Logger system - not globally.

0 Likes
Meisch Super Contributor.
Super Contributor.

Re: Can I change the internal port for ESM for port 8089?

Thank you sir...

Logs, logs and more logs
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.