Since I use Deployment Server all the time, and tell all my clients to:
What timerange does ./splunk list deploy-clients actually report on? Is it machines that have checked into the Deployment Server in the past ... 30 seconds? One minute?
Actually, in testing, I found that around 2 minutes is the time range.
The results of my command watch -n 15 'date >> /opt/deploy.log && splunk list deploy-clients |grep "IPADDRESS" >> /opt/deploy.log'
are found in pastebin below. I stopped the forwarder between the
11:52:55 and 11:53:10 times. I then started the forwarder after the 11:55:57 time. Also, default for phoneHomeIntervalInSecs is 60.
UPDATE NOTE: The timeout may be dependent on your system and what configuration options you have set.
Hi piebob, I cannot decide it, because there is still no 'real' answer 😉
if Jason doesn't decide by the end of today, MuS shall decide!
Hi Jason, I will do it if you don't want to decide it 😉
bonus! Now I get to decide who is right...
Actually, in testing, I found that around 2 minutes is the time range.
The results of my command watch -n 15 'date >> /opt/deploy.log && splunk list deploy-clients |grep "IPADDRESS" >> /opt/deploy.log'
are found in pastebin below. I stopped the forwarder between the
11:52:55 and 11:53:10 times. I then started the forwarder after the 11:55:57 time. Also, default for phoneHomeIntervalInSecs is 60.
UPDATE NOTE: The timeout may be dependent on your system and what configuration options you have set.
aaand the extra 50 points goes to Alacer!
This has been verified by Splunk. It's every 2 minutes.
From what I understand it's 2 minutes no matter what your phoneHomeInterval is.
Annnd we have a winner. 2mins was verified by dev. Thanks for your testing folks, I've always wondered about this one.
So I reran with phoneHomeInterval = 120. After 2 minutes, the deployment server stopped reporting the client, and within 30 seconds of the drop, it came back after the client phoned home. So I'm thinking 2 minutes is about the timeout.
that's a nice one and we already figured that out.
Still the questions remains: what is the exact time range ' ./splunk list deploy-clients' reports on and how could this be changed? If you have phoneHomeIntervallinSecs set to 600 then you will have (with the current setting) clients that never show up...
i will award an extra 50 karma points for an accepted* answer to this question.
*(either the original asker accepts, or MuS says it worked 🙂 )
bump - would be nice to know what time range is used 😉