This article describes an issue where, while testing connecting to Windows log sources using the MSRPC protocol and the test connection fails with below error:

"Error: Broken pipe (Write failed)" 

1. Windows log sources have a status of ERROR
2. Test Connection fails while fetching events with "Error: Broken pipe(Write failed)"

To enable communication between your Windows host and JSA over MSRPC, please configure the Remote Procedure Calls (RPC) settings on the Windows host for the Microsoft Remote Procedure Calls (MSRPC) protocol. You must be a member of the administrators group to enable communication over MSRPC between your Windows host and the JSA appliance.

The main settings for the MSRPC protocol for the Windows log source can be found at https://www.juniper.net/documentation/us/en/software/jsa7.5.0/jsa-dsm/topics/concept/concept-jsa-configuring-dsm-microsoft-windows-security-event-log.html.

Once the protocol settings have been configured as per the above link, you can perform a Test Connection to the Windows host to check whether JSA is able to connect to the host. The test connection happens in two stages.

1. Establishing connection to the Windows host.
2. Pulling events from the Event Source of the Windows host (This depends on the event types specified in the MSRPC protocol configuration for this Windows host)

When JSA is establishing a connection to the Windows host, it performs the below steps:

1. Testing the DNS resolution of the log source identifier of the Windows host
2. Performing a TCP connection on port 135
3. Attempting to obtain the dynamic port (if it is configured on the Windows host)
4. Once it receives the dynamic port value from the Windows host, it will try to establish a TCP connection on that dynamic port value.

Once JSA establishes the connection, it will try to fetch the events depending on the event types defined in the protocol configuration. While fetching the events, if you face a "Error: Broken pipe (Write failed)" error, please make sure that the "Domain" field in the protocol configuration is present. Below is an example of the log source test connection when the domain field is not specified in the protocol configuration.

When we perform a test connection, JSA can establish the connection on port 135 as well as the dynamic port value to the Windows host but fails to retrieve the events as shown below.

When we add the domain name and perform a test connection, the events can be retrieved successfully.