Description

This article explains how to resolve the "Your Splunk License Has Expired or Exceeded the Limit Too Many Times" alarm on vSWA.

Symptoms

When this issue occurs, the Corero system generates the following alarm:

Your Splunk license has expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK.

Additionally, the connection status of both vSWA and vCMS appears as "Not Connected" when running the show securewatch command:

vCMS Output:

cms> show securewatch  
SecureWatch Status:  
          State   : Not Connected  
          Reason  : Connection attempt in progress  
SecureWatch ID : vcmsxxxx

vSWA Output:

vswa> show securewatch  
SecureWatch Status:  
          State   : Not Connected  
          Reason  : Connection attempt in progress  
SecureWatch ID : vswaxxxx

Solution

This issue occurs when the vCMS or vSWA is unable to connect to the SecureWatch License server via OpenVPN.  To resolve the issue, follow these steps:

1. Verify Internet Connectivity

Ensure that both the vCMS and vSWA have active internet access.

2. Allow Required IP Addresses

Make sure the following IP addresses are reachable over TCP port 443:

  • 3.13.10.107
  • 35.155.55.233
  • 35.158.5.95
  • 3.127.221.235

If a proxy server is used for internet access, confirm that it can also reach these addresses over port 443.

3. Understand Licensing Behavior

If the vCMS or vSWA loses connection to the SecureWatch License server, the vSWA will stop functioning after 5 days. This is a licensing restriction enforced by Splunk and cannot be modified. Maintaining a SecureWatch connection is essential for vSWA to remain licensed and operational.

4. Restart SecureWatch Service

If connectivity is confirmed but the issue persists, restart the SecureWatch service:

On vCMS:

1. SSH to the vCMS on port 2222 using the admin account:
   $ ssh admin@<vcms-ip> -p 2222
   
2. Disable and re-enable the SecureWatch connection:
   vCMS> securewatch disable  
   vCMS> securewatch enable

On vSWA:

Repeat the same steps above using the vSWA CLI.

5. Contact JTAC

If the issue continues, contact JTAC for further assistance. Provide the following:

  • The SecureWatch support token from the vSWA
  • A screenshot of the System Health page

To retrieve the support token:
vSWA> support-account status
Support account status: Disabled

vSWA> support-account enable
Support token: ABC1DEF3

Modification History

2025-05-09 : Added section to collect token and contact JTAC
2025-02-15 : Article Created